Marcus Updateinfo to OVAL Converter5.52023-10-19T04:54:53CVE-1999-0077SUSE Linux Enterprise Micro 5.0
Predictable TCP sequence numbers allow spoofing.
ModerateCVE-1999-0077SUSE bug 954946cpe:/o:suse:suse-microos:5.0CVE-1999-0195SUSE Linux Enterprise Micro 5.0
Denial of service in RPC portmapper allows attackers to register or unregister RPC services or spoof RPC services using a spoofed source IP address such as 127.0.0.1.
ModerateCVE-1999-0195SUSE bug 914171cpe:/o:suse:suse-microos:5.0CVE-1999-0524SUSE Linux Enterprise Micro 5.0
ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.
LowCVE-1999-0524SUSE bug 351997SUSE bug 992991cpe:/o:suse:suse-microos:5.0CVE-2000-1254SUSE Linux Enterprise Micro 5.0
crypto/rsa/rsa_gen.c in OpenSSL before 0.9.6 mishandles C bitwise-shift operations that exceed the size of an expression, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging improper RSA key generation on 64-bit HP-UX platforms.
ModerateCVE-2000-1254SUSE bug 978847cpe:/o:suse:suse-microos:5.0CVE-2001-0405SUSE Linux Enterprise Micro 5.0
ip_conntrack_ftp in the IPTables firewall for Linux 2.4 allows remote attackers to bypass access restrictions for an FTP server via a PORT command that lists an arbitrary IP address and port number, which is added to the RELATED table and allowed by the firewall.
ImportantCVE-2001-0405cpe:/o:suse:suse-microos:5.0CVE-2001-0851SUSE Linux Enterprise Micro 5.0
Linux kernel 2.0, 2.2 and 2.4 with syncookies enabled allows remote attackers to bypass firewall rules by brute force guessing the cookie.
ImportantCVE-2001-0851SUSE bug 1175687cpe:/o:suse:suse-microos:5.0CVE-2002-20001SUSE Linux Enterprise Micro 5.0
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.
ImportantCVE-2002-20001SUSE bug 1192815SUSE bug 1199367cpe:/o:suse:suse-microos:5.0CVE-2003-0252SUSE Linux Enterprise Micro 5.0
Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines.
CriticalCVE-2003-0252SUSE bug 42744SUSE bug 42918cpe:/o:suse:suse-microos:5.0CVE-2003-1605SUSE Linux Enterprise Micro 5.0
curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server.
ImportantCVE-2003-1605SUSE bug 1105868cpe:/o:suse:suse-microos:5.0CVE-2004-0790SUSE Linux Enterprise Micro 5.0
Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
ModerateCVE-2004-0790SUSE bug 1173637SUSE bug 1173639SUSE bug 1173640SUSE bug 1173642SUSE bug 1173643SUSE bug 1173644SUSE bug 1173645cpe:/o:suse:suse-microos:5.0CVE-2004-0791SUSE Linux Enterprise Micro 5.0
Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
ModerateCVE-2004-0791SUSE bug 1173637SUSE bug 1173639SUSE bug 1173640SUSE bug 1173642SUSE bug 1173643SUSE bug 1173644SUSE bug 1173645cpe:/o:suse:suse-microos:5.0CVE-2004-1060SUSE Linux Enterprise Micro 5.0
Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
ModerateCVE-2004-1060SUSE bug 1173637SUSE bug 1173639SUSE bug 1173640SUSE bug 1173642SUSE bug 1173643SUSE bug 1173644SUSE bug 1173645cpe:/o:suse:suse-microos:5.0CVE-2005-0065SUSE Linux Enterprise Micro 5.0
The original design of TCP does not check that the TCP sequence number in an ICMP error message is within the range of sequence numbers for data that has been sent but not acknowledged (aka "TCP sequence number checking"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
ImportantCVE-2005-0065SUSE bug 1173637SUSE bug 1173639SUSE bug 1173640SUSE bug 1173642SUSE bug 1173643SUSE bug 1173644SUSE bug 1173645cpe:/o:suse:suse-microos:5.0CVE-2005-0066SUSE Linux Enterprise Micro 5.0
The original design of TCP does not check that the TCP Acknowledgement number in an ICMP error message generated by an intermediate router is within the range of possible values for data that has already been acknowledged (aka "TCP acknowledgement number checking"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
ModerateCVE-2005-0066SUSE bug 1173637SUSE bug 1173639SUSE bug 1173640SUSE bug 1173642SUSE bug 1173643SUSE bug 1173644SUSE bug 1173645cpe:/o:suse:suse-microos:5.0CVE-2005-0067SUSE Linux Enterprise Micro 5.0
The original design of TCP does not require that port numbers be assigned randomly (aka "Port randomization"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
ModerateCVE-2005-0067SUSE bug 1173637SUSE bug 1173639SUSE bug 1173640SUSE bug 1173642SUSE bug 1173643SUSE bug 1173644SUSE bug 1173645cpe:/o:suse:suse-microos:5.0CVE-2005-0068SUSE Linux Enterprise Micro 5.0
The original design of ICMP does not require authentication for host-generated ICMP error messages, which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
ModerateCVE-2005-0068SUSE bug 1173637SUSE bug 1173639SUSE bug 1173640SUSE bug 1173642SUSE bug 1173643SUSE bug 1173644SUSE bug 1173645cpe:/o:suse:suse-microos:5.0CVE-2005-0210SUSE Linux Enterprise Micro 5.0
Netfilter in the Linux kernel 2.6.8.1 allows local users to cause a denial of service (memory consumption) via certain packet fragments that are reassembled twice, which causes a data structure to be allocated twice.
ModerateCVE-2005-0210SUSE bug 65594cpe:/o:suse:suse-microos:5.0CVE-2005-0400SUSE Linux Enterprise Micro 5.0
The ext2_make_empty function call in the Linux kernel before 2.6.11.6 does not properly initialize memory when creating a block for a new directory entry, which allows local users to obtain potentially sensitive information by reading the block.
LowCVE-2005-0400SUSE bug 75706cpe:/o:suse:suse-microos:5.0CVE-2005-0749SUSE Linux Enterprise Micro 5.0
The load_elf_library in the Linux kernel before 2.6.11.6 allows local users to cause a denial of service (kernel crash) via a crafted ELF library or executable, which causes a free of an invalid pointer.
ImportantCVE-2005-0749SUSE bug 73837cpe:/o:suse:suse-microos:5.0CVE-2005-1265SUSE Linux Enterprise Micro 5.0
The mmap function in the Linux Kernel 2.6.10 can be used to create memory maps with a start address beyond the end address, which allows local users to cause a denial of service (kernel crash).
ModerateCVE-2005-1265SUSE bug 84728cpe:/o:suse:suse-microos:5.0CVE-2005-1763SUSE Linux Enterprise Micro 5.0
Buffer overflow in ptrace in the Linux Kernel for 64-bit architectures allows local users to write bytes into kernel memory.
ImportantCVE-2005-1763SUSE bug 84078cpe:/o:suse:suse-microos:5.0CVE-2005-1767SUSE Linux Enterprise Micro 5.0
traps.c in the Linux kernel 2.6.x and 2.4.x executes stack segment faults on an exception stack, which allows local users to cause a denial of service (oops and stack fault exception).
LowCVE-2005-1767SUSE bug 88492SUSE bug 90500cpe:/o:suse:suse-microos:5.0CVE-2005-2098SUSE Linux Enterprise Micro 5.0
The KEYCTL_JOIN_SESSION_KEYRING operation in the Linux kernel before 2.6.12.5 contains an error path that does not properly release the session management semaphore, which allows local users or remote attackers to cause a denial of service (semaphore hang) via a new session keyring (1) with an empty name string, (2) with a long name string, (3) with the key quota reached, or (4) ENOMEM.
ModerateCVE-2005-2098SUSE bug 100506cpe:/o:suse:suse-microos:5.0CVE-2005-2458SUSE Linux Enterprise Micro 5.0
inflate.c in the zlib routines in the Linux kernel before 2.6.12.5 allows remote attackers to cause a denial of service (kernel crash) via a compressed file with "improper tables".
ModerateCVE-2005-2458SUSE bug 100428SUSE bug 102323SUSE bug 104085SUSE bug 114364SUSE bug 117169SUSE bug 130270SUSE bug 132739SUSE bug 133577SUSE bug 133972cpe:/o:suse:suse-microos:5.0CVE-2005-2492SUSE Linux Enterprise Micro 5.0
The raw_sendmsg function in the Linux kernel 2.6 before 2.6.13.1 allows local users to cause a denial of service (change hardware state) or read from arbitrary memory via crafted input.
LowCVE-2005-2492SUSE bug 114365cpe:/o:suse:suse-microos:5.0CVE-2005-3623SUSE Linux Enterprise Micro 5.0
nfs2acl.c in the Linux kernel 2.6.14.4 does not check for MAY_SATTR privilege before setting access controls (ACL) on files on exported NFS filesystems, which allows remote attackers to bypass ACLs for readonly mounted NFS filesystems.
ImportantCVE-2005-3623SUSE bug 139411cpe:/o:suse:suse-microos:5.0CVE-2005-4881SUSE Linux Enterprise Micro 5.0
The netlink subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.13-rc1 does not initialize certain padding fields in structures, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors, related to the (1) tc_fill_qdisc, (2) tcf_fill_node, (3) neightbl_fill_info, (4) neightbl_fill_param_info, (5) neigh_fill_info, (6) rtnetlink_fill_ifinfo, (7) rtnetlink_fill_iwinfo, (8) vif_delete, (9) ipmr_destroy_unres, (10) ipmr_cache_alloc_unres, (11) ipmr_cache_resolve, (12) inet6_fill_ifinfo, (13) tca_get_fill, (14) tca_action_flush, (15) tcf_add_notify, (16) tc_dump_action, (17) cbq_dump_police, (18) __nlmsg_put, (19) __rta_fill, (20) __rta_reserve, (21) inet6_fill_prefix, (22) rsvp_dump, and (23) cbq_dump_ovl functions.
ModerateCVE-2005-4881SUSE bug 536467cpe:/o:suse:suse-microos:5.0CVE-2006-3635SUSE Linux Enterprise Micro 5.0
The ia64 subsystem in the Linux kernel before 2.6.26 allows local users to cause a denial of service (stack consumption and system crash) via a crafted application that leverages the mishandling of invalid Register Stack Engine (RSE) state.
ImportantCVE-2006-3635SUSE bug 199440SUSE bug 199441cpe:/o:suse:suse-microos:5.0CVE-2006-4623SUSE Linux Enterprise Micro 5.0
The Unidirectional Lightweight Encapsulation (ULE) decapsulation component in dvb-core/dvb_net.c in the dvb driver in the Linux kernel 2.6.17.8 allows remote attackers to cause a denial of service (crash) via an SNDU length of 0 in a ULE packet.
ImportantCVE-2006-4623SUSE bug 201429cpe:/o:suse:suse-microos:5.0CVE-2006-4814SUSE Linux Enterprise Micro 5.0
The mincore function in the Linux kernel before 2.4.33.6 does not properly lock access to user space, which has unspecified impact and attack vectors, possibly related to a deadlock.
ModerateCVE-2006-4814SUSE bug 207667cpe:/o:suse:suse-microos:5.0CVE-2006-5701SUSE Linux Enterprise Micro 5.0
Double free vulnerability in squashfs module in the Linux kernel 2.6.x, as used in Fedora Core 5 and possibly other distributions, allows local users to cause a denial of service by mounting a crafted squashfs filesystem.
ModerateCVE-2006-5701SUSE bug 218162cpe:/o:suse:suse-microos:5.0CVE-2006-5751SUSE Linux Enterprise Micro 5.0
Integer overflow in the get_fdb_entries function in net/bridge/br_ioctl.c in the Linux kernel before 2.6.18.4 allows local users to execute arbitrary code via a large maxnum value in an ioctl request.
ImportantCVE-2006-5751SUSE bug 222656cpe:/o:suse:suse-microos:5.0CVE-2006-5794SUSE Linux Enterprise Micro 5.0
Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow attackers to bypass authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging vulnerabilities in the unprivileged process, which are not known to exist.
ImportantCVE-2006-5794SUSE bug 219115cpe:/o:suse:suse-microos:5.0CVE-2006-6106SUSE Linux Enterprise Micro 5.0
Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net/bluetooth/cmtp/capi.c) in the Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 before 2.6.18.6, and 2.6.19.x, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via CAPI messages with a large value for the length of the (1) manu (manufacturer) or (2) serial (serial number) field.
ImportantCVE-2006-6106SUSE bug 227603cpe:/o:suse:suse-microos:5.0CVE-2006-7246SUSE Linux Enterprise Micro 5.0
NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.
ModerateCVE-2006-7246SUSE bug 1047509SUSE bug 1047511SUSE bug 574266SUSE bug 777228cpe:/o:suse:suse-microos:5.0CVE-2007-0005SUSE Linux Enterprise Micro 5.0
Multiple buffer overflows in the (1) read and (2) write handlers in the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3 allow local users to gain privileges.
ModerateCVE-2007-0005SUSE bug 242996cpe:/o:suse:suse-microos:5.0CVE-2007-1496SUSE Linux Enterprise Micro 5.0
nfnetlink_log in netfilter in the Linux kernel before 2.6.20.3 allows attackers to cause a denial of service (crash) via unspecified vectors involving the (1) nfulnl_recv_config function, (2) using "multiple packets per netlink message", and (3) bridged packets, which trigger a NULL pointer dereference.
ModerateCVE-2007-1496SUSE bug 270458cpe:/o:suse:suse-microos:5.0CVE-2007-1497SUSE Linux Enterprise Micro 5.0
nf_conntrack in netfilter in the Linux kernel before 2.6.20.3 does not set nfctinfo during reassembly of fragmented packets, which leaves the default value as IP_CT_ESTABLISHED and might allow remote attackers to bypass certain rulesets using IPv6 fragments.
ImportantCVE-2007-1497SUSE bug 268298SUSE bug 270460cpe:/o:suse:suse-microos:5.0CVE-2007-2875SUSE Linux Enterprise Micro 5.0
Integer underflow in the cpuset_tasks_read function in the Linux kernel before 2.6.20.13, and 2.6.21.x before 2.6.21.4, when the cpuset filesystem is mounted, allows local users to obtain kernel memory contents by using a large offset when reading the /dev/cpuset/tasks file.
LowCVE-2007-2875SUSE bug 280819cpe:/o:suse:suse-microos:5.0CVE-2007-2878SUSE Linux Enterprise Micro 5.0
The VFAT compat ioctls in the Linux kernel before 2.6.21.2, when run on a 64-bit system, allow local users to corrupt a kernel_dirent struct and cause a denial of service (system crash) via unknown vectors.
ModerateCVE-2007-2878SUSE bug 280888cpe:/o:suse:suse-microos:5.0CVE-2007-3104SUSE Linux Enterprise Micro 5.0
The sysfs_readdir function in the Linux kernel 2.6, as used in Red Hat Enterprise Linux (RHEL) 4.5 and other distributions, allows users to cause a denial of service (kernel OOPS) by dereferencing a null pointer to an inode in a dentry.
ModerateCVE-2007-3104SUSE bug 329758cpe:/o:suse:suse-microos:5.0CVE-2007-3107SUSE Linux Enterprise Micro 5.0
The signal handling in the Linux kernel before 2.6.22, including 2.6.2, when running on PowerPC systems using HTX, allows local users to cause a denial of service via unspecified vectors involving floating point corruption and concurrency, related to clearing of MSR bits.
LowCVE-2007-3107SUSE bug 290622SUSE bug 329765cpe:/o:suse:suse-microos:5.0CVE-2007-3513SUSE Linux Enterprise Micro 5.0
The lcd_write function in drivers/usb/misc/usblcd.c in the Linux kernel before 2.6.22-rc7 does not limit the amount of memory used by a caller, which allows local users to cause a denial of service (memory consumption).
ModerateCVE-2007-3513SUSE bug 293092cpe:/o:suse:suse-microos:5.0CVE-2007-3719SUSE Linux Enterprise Micro 5.0
The process scheduler in the Linux kernel 2.6.16 gives preference to "interactive" processes that perform voluntary sleeps, which allows local users to cause a denial of service (CPU consumption), as described in "Secretly Monopolizing the CPU Without Superuser Privileges."
LowCVE-2007-3719SUSE bug 291701cpe:/o:suse:suse-microos:5.0CVE-2007-3851SUSE Linux Enterprise Micro 5.0
The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.
ModerateCVE-2007-3851SUSE bug 298309cpe:/o:suse:suse-microos:5.0CVE-2007-4308SUSE Linux Enterprise Micro 5.0
The (1) aac_cfg_open and (2) aac_compat_ioctl functions in the SCSI layer ioctl path in aacraid in the Linux kernel before 2.6.23-rc2 do not check permissions for ioctls, which might allow local users to cause a denial of service or gain privileges.
ImportantCVE-2007-4308SUSE bug 326270SUSE bug 329764cpe:/o:suse:suse-microos:5.0CVE-2007-4567SUSE Linux Enterprise Micro 5.0
The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.22 does not properly validate the hop-by-hop IPv6 extended header, which allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted IPv6 packet.
ImportantCVE-2007-4567SUSE bug 307626SUSE bug 570608cpe:/o:suse:suse-microos:5.0CVE-2007-4571SUSE Linux Enterprise Micro 5.0
The snd_mem_proc_read function in sound/core/memalloc.c in the Advanced Linux Sound Architecture (ALSA) in the Linux kernel before 2.6.22.8 does not return the correct write size, which allows local users to obtain sensitive information (kernel memory contents) via a small count argument, as demonstrated by multiple reads of /proc/driver/snd-page-alloc.
LowCVE-2007-4571SUSE bug 328404cpe:/o:suse:suse-microos:5.0CVE-2007-4774SUSE Linux Enterprise Micro 5.0
The Linux kernel before 2.4.36-rc1 has a race condition. It was possible to bypass systrace policies by flooding the ptraced process with SIGCONT signals, which can can wake up a PTRACED process.
ModerateCVE-2007-4774SUSE bug 1161116cpe:/o:suse:suse-microos:5.0CVE-2007-5966SUSE Linux Enterprise Micro 5.0
Integer overflow in the hrtimer_start function in kernel/hrtimer.c in the Linux kernel before 2.6.23.10 allows local users to execute arbitrary code or cause a denial of service (panic) via a large relative timeout value. NOTE: some of these details are obtained from third party information.
ImportantCVE-2007-5966SUSE bug 347262SUSE bug 512584cpe:/o:suse:suse-microos:5.0CVE-2007-6063SUSE Linux Enterprise Micro 5.0
Buffer overflow in the isdn_net_setcfg function in isdn_net.c in Linux kernel 2.6.23 allows local users to have an unknown impact via a crafted argument to the isdn_ioctl function.
ModerateCVE-2007-6063SUSE bug 343210cpe:/o:suse:suse-microos:5.0CVE-2007-6206SUSE Linux Enterprise Micro 5.0
The do_coredump function in fs/exec.c in Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3, and possibly other versions, does not change the UID of a core dump file if it exists before a root process creates a core dump in the same location, which might allow local users to obtain sensitive information.
LowCVE-2007-6206SUSE bug 342686cpe:/o:suse:suse-microos:5.0CVE-2007-6716SUSE Linux Enterprise Micro 5.0
fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service (OOPS), as demonstrated by a certain fio test.
ModerateCVE-2007-6716SUSE bug 422963cpe:/o:suse:suse-microos:5.0CVE-2007-6762SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 2.6.20, there is an off-by-one bug in net/netlabel/netlabel_cipso_v4.c where it is possible to overflow the doi_def->tags[] array.
CriticalCVE-2007-6762SUSE bug 1143172cpe:/o:suse:suse-microos:5.0CVE-2008-0007SUSE Linux Enterprise Micro 5.0
Linux kernel before 2.6.22.17, when using certain drivers that register a fault handler that does not perform range checks, allows local users to access kernel memory via an out-of-range offset.
ImportantCVE-2008-0007SUSE bug 353207cpe:/o:suse:suse-microos:5.0CVE-2008-0009SUSE Linux Enterprise Micro 5.0
The vmsplice_to_user function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before dereference, which might allow local users to access arbitrary kernel memory locations.
ImportantCVE-2008-0009SUSE bug 358006cpe:/o:suse:suse-microos:5.0CVE-2008-0352SUSE Linux Enterprise Micro 5.0
The Linux kernel 2.6.20 through 2.6.21.1 allows remote attackers to cause a denial of service (panic) via a certain IPv6 packet, possibly involving the Jumbo Payload hop-by-hop option (jumbogram).
ImportantCVE-2008-0352SUSE bug 307626cpe:/o:suse:suse-microos:5.0CVE-2008-1367SUSE Linux Enterprise Micro 5.0
gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag (DF) from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signal handling in the Linux kernel, which might allow context-dependent attackers to trigger memory corruption. NOTE: this issue was originally reported for CPU consumption in SBCL.
ImportantCVE-2008-1367SUSE bug 369911SUSE bug 372038cpe:/o:suse:suse-microos:5.0CVE-2008-1420SUSE Linux Enterprise Micro 5.0
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
ImportantCVE-2008-1420SUSE bug 372246cpe:/o:suse:suse-microos:5.0CVE-2008-1483SUSE Linux Enterprise Micro 5.0
OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs.
ImportantCVE-2008-1483SUSE bug 1069509SUSE bug 373527SUSE bug 585630SUSE bug 647633SUSE bug 706386cpe:/o:suse:suse-microos:5.0CVE-2008-2358SUSE Linux Enterprise Micro 5.0
Integer overflow in the dccp_feat_change function in net/dccp/feat.c in the Datagram Congestion Control Protocol (DCCP) subsystem in the Linux kernel 2.6.18, and 2.6.17 through 2.6.20, allows local users to gain privileges via an invalid feature length, which leads to a heap-based buffer overflow.
ImportantCVE-2008-2358SUSE bug 387819cpe:/o:suse:suse-microos:5.0CVE-2008-2365SUSE Linux Enterprise Micro 5.0
Race condition in the ptrace and utrace support in the Linux kernel 2.6.9 through 2.6.25, as used in Red Hat Enterprise Linux (RHEL) 4, allows local users to cause a denial of service (oops) via a long series of PTRACE_ATTACH ptrace calls to another user's process that trigger a conflict between utrace_detach and report_quiescent, related to "late ptrace_may_attach() check" and "race around &dead_engine_ops setting," a different vulnerability than CVE-2007-0771 and CVE-2008-1514. NOTE: this issue might only affect kernel versions before 2.6.16.x.
ModerateCVE-2008-2365SUSE bug 404288cpe:/o:suse:suse-microos:5.0CVE-2008-2544SUSE Linux Enterprise Micro 5.0
Mounting /proc filesystem via chroot command silently mounts it in read-write mode. The user could bypass the chroot environment and gain write access to files, he would never have otherwise.
ModerateCVE-2008-2544SUSE bug 1189500cpe:/o:suse:suse-microos:5.0CVE-2008-2750SUSE Linux Enterprise Micro 5.0
The pppol2tp_recvmsg function in drivers/net/pppol2tp.c in the Linux kernel 2.6 before 2.6.26-rc6 allows remote attackers to cause a denial of service (kernel heap memory corruption and system crash) and possibly have unspecified other impact via a crafted PPPOL2TP packet that results in a large value for a certain length variable.
ImportantCVE-2008-2750SUSE bug 400874cpe:/o:suse:suse-microos:5.0CVE-2008-2812SUSE Linux Enterprise Micro 5.0
The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving NULL pointer dereference of function pointers in (1) hamradio/6pack.c, (2) hamradio/mkiss.c, (3) irda/irtty-sir.c, (4) ppp_async.c, (5) ppp_synctty.c, (6) slip.c, (7) wan/x25_asy.c, and (8) wireless/strip.c in drivers/net/.
ImportantCVE-2008-2812SUSE bug 1175688SUSE bug 405017cpe:/o:suse:suse-microos:5.0CVE-2008-2826SUSE Linux Enterprise Micro 5.0
Integer overflow in the sctp_getsockopt_local_addrs_old function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) functionality in the Linux kernel before 2.6.25.9 allows local users to cause a denial of service (resource consumption and system outage) via vectors involving a large addr_num field in an sctp_getaddrs_old data structure.
ModerateCVE-2008-2826SUSE bug 402607cpe:/o:suse:suse-microos:5.0CVE-2008-2931SUSE Linux Enterprise Micro 5.0
The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint.
ImportantCVE-2008-2931SUSE bug 1175780SUSE bug 407428cpe:/o:suse:suse-microos:5.0CVE-2008-3247SUSE Linux Enterprise Micro 5.0
The LDT implementation in the Linux kernel 2.6.25.x before 2.6.25.11 on x86_64 platforms uses an incorrect size for ldt_desc, which allows local users to cause a denial of service (system crash) or possibly gain privileges via unspecified vectors.
ImportantCVE-2008-3247SUSE bug 408734SUSE bug 432488cpe:/o:suse:suse-microos:5.0CVE-2008-3275SUSE Linux Enterprise Micro 5.0
The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a deleted (aka S_DEAD) directory, which allows local users to cause a denial of service ("overflow" of the UBIFS orphan area) via a series of attempted file creations within deleted directories.
ModerateCVE-2008-3275SUSE bug 413936cpe:/o:suse:suse-microos:5.0CVE-2008-3496SUSE Linux Enterprise Micro 5.0
Buffer overflow in format descriptor parsing in the uvc_parse_format function in drivers/media/video/uvc/uvc_driver.c in uvcvideo in the video4linux (V4L) implementation in the Linux kernel before 2.6.26.1 has unknown impact and attack vectors.
CriticalCVE-2008-3496SUSE bug 415702cpe:/o:suse:suse-microos:5.0CVE-2008-3526SUSE Linux Enterprise Micro 5.0
Integer overflow in the sctp_setsockopt_auth_key function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel 2.6.24-rc1 through 2.6.26.3 allows remote attackers to cause a denial of service (panic) or possibly have unspecified other impact via a crafted sca_keylength field associated with the SCTP_AUTH_KEY option.
ImportantCVE-2008-3526SUSE bug 421003cpe:/o:suse:suse-microos:5.0CVE-2008-3527SUSE Linux Enterprise Micro 5.0
arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared Objects (vDSO) implementation in the Linux kernel before 2.6.21 does not properly check boundaries, which allows local users to gain privileges or cause a denial of service via unspecified vectors, related to the install_special_mapping, syscall, and syscall32_nopage functions.
ModerateCVE-2008-3527SUSE bug 437689cpe:/o:suse:suse-microos:5.0CVE-2008-3528SUSE Linux Enterprise Micro 5.0
The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that report directory corruption, which allows physically proximate attackers to cause a denial of service (temporary system hang) by mounting a filesystem that has corrupted dir->i_size and dir->i_blocks values and performing (a) read or (b) write operations. NOTE: there are limited scenarios in which this crosses privilege boundaries.
ModerateCVE-2008-3528SUSE bug 427244cpe:/o:suse:suse-microos:5.0CVE-2008-3534SUSE Linux Enterprise Micro 5.0
The shmem_delete_inode function in mm/shmem.c in the tmpfs implementation in the Linux kernel before 2.6.26.1 allows local users to cause a denial of service (system crash) via a certain sequence of file create, remove, and overwrite operations, as demonstrated by the insserv program, related to allocation of "useless pages" and improper maintenance of the i_blocks count.
ModerateCVE-2008-3534SUSE bug 414257cpe:/o:suse:suse-microos:5.0CVE-2008-3792SUSE Linux Enterprise Micro 5.0
net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4 does not verify that the SCTP-AUTH extension is enabled before proceeding with SCTP-AUTH API functions, which allows attackers to cause a denial of service (NULL pointer dereference and panic) via vectors that result in calls to (1) sctp_setsockopt_auth_chunk, (2) sctp_setsockopt_hmac_ident, (3) sctp_setsockopt_auth_key, (4) sctp_setsockopt_active_key, (5) sctp_setsockopt_del_key, (6) sctp_getsockopt_maxburst, (7) sctp_getsockopt_active_key, (8) sctp_getsockopt_peer_auth_chunks, or (9) sctp_getsockopt_local_auth_chunks.
ImportantCVE-2008-3792SUSE bug 423541cpe:/o:suse:suse-microos:5.0CVE-2008-3831SUSE Linux Enterprise Micro 5.0
The i915 driver in (1) drivers/char/drm/i915_dma.c in the Linux kernel 2.6.24 on Debian GNU/Linux and (2) sys/dev/pci/drm/i915_drv.c in OpenBSD does not restrict the DRM_I915_HWS_ADDR ioctl to the Direct Rendering Manager (DRM) master, which allows local users to cause a denial of service (memory corruption) via a crafted ioctl call, related to absence of the DRM_MASTER and DRM_ROOT_ONLY flags in the ioctl's configuration.
ImportantCVE-2008-3831SUSE bug 429919cpe:/o:suse:suse-microos:5.0CVE-2008-3833SUSE Linux Enterprise Micro 5.0
The generic_file_splice_write function in fs/splice.c in the Linux kernel before 2.6.19 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by splicing into an inode in order to create an executable file in a setgid directory, a different vulnerability than CVE-2008-4210.
ModerateCVE-2008-3833SUSE bug 432487cpe:/o:suse:suse-microos:5.0CVE-2008-3915SUSE Linux Enterprise Micro 5.0
Buffer overflow in nfsd in the Linux kernel before 2.6.26.4, when NFSv4 is enabled, allows remote attackers to have an unknown impact via vectors related to decoding an NFSv4 acl.
CriticalCVE-2008-3915SUSE bug 423515cpe:/o:suse:suse-microos:5.0CVE-2008-4113SUSE Linux Enterprise Micro 5.0
The sctp_getsockopt_hmac_ident function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4, when the SCTP-AUTH extension is enabled, relies on an untrusted length value to limit copying of data from kernel memory, which allows local users to obtain sensitive information via a crafted SCTP_HMAC_IDENT IOCTL request involving the sctp_getsockopt function.
ModerateCVE-2008-4113SUSE bug 429781SUSE bug 432898cpe:/o:suse:suse-microos:5.0CVE-2008-4210SUSE Linux Enterprise Micro 5.0
fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.
ImportantCVE-2008-4210SUSE bug 429478SUSE bug 432487cpe:/o:suse:suse-microos:5.0CVE-2008-4302SUSE Linux Enterprise Micro 5.0
fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by the fio I/O tool.
ModerateCVE-2008-4302SUSE bug 427651cpe:/o:suse:suse-microos:5.0CVE-2008-4307SUSE Linux Enterprise Micro 5.0
Race condition in the do_setlk function in fs/nfs/file.c in the Linux kernel before 2.6.26 allows local users to cause a denial of service (crash) via vectors resulting in an interrupted RPC call that leads to a stray FL_POSIX lock, related to improper handling of a race between fcntl and close in the EINTR case.
LowCVE-2008-4307SUSE bug 465672cpe:/o:suse:suse-microos:5.0CVE-2008-4409SUSE Linux Enterprise Micro 5.0
libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.
ModerateCVE-2008-4409SUSE bug 432486cpe:/o:suse:suse-microos:5.0CVE-2008-4445SUSE Linux Enterprise Micro 5.0
The sctp_auth_ep_set_hmacs function in net/sctp/auth.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4, when the SCTP-AUTH extension is enabled, does not verify that the identifier index is within the bounds established by SCTP_AUTH_HMAC_ID_MAX, which allows local users to obtain sensitive information via a crafted SCTP_HMAC_IDENT IOCTL request involving the sctp_getsockopt function, a different vulnerability than CVE-2008-4113.
ModerateCVE-2008-4445SUSE bug 432898cpe:/o:suse:suse-microos:5.0CVE-2008-4554SUSE Linux Enterprise Micro 5.0
The do_splice_from function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the O_APPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file.
ModerateCVE-2008-4554SUSE bug 435151cpe:/o:suse:suse-microos:5.0CVE-2008-5029SUSE Linux Enterprise Micro 5.0
The __scm_destroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and earlier makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service (panic) via vectors related to sending an SCM_RIGHTS message through a UNIX domain socket and closing file descriptors.
ModerateCVE-2008-5029SUSE bug 442364SUSE bug 449739cpe:/o:suse:suse-microos:5.0CVE-2008-5079SUSE Linux Enterprise Micro 5.0
net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8 and earlier allows local users to cause a denial of service (kernel infinite loop) by making two calls to svc_listen for the same socket, and then reading a /proc/net/atm/*vc file, related to corruption of the vcc table.
ModerateCVE-2008-5079SUSE bug 450417cpe:/o:suse:suse-microos:5.0CVE-2008-5700SUSE Linux Enterprise Micro 5.0
libata in the Linux kernel before 2.6.27.9 does not set minimum timeouts for SG_IO requests, which allows local users to cause a denial of service (Programmed I/O mode on drives) via multiple simultaneous invocations of an unspecified test program.
LowCVE-2008-5700SUSE bug 457896cpe:/o:suse:suse-microos:5.0CVE-2008-5702SUSE Linux Enterprise Micro 5.0
Buffer underflow in the ibwdt_ioctl function in drivers/watchdog/ib700wdt.c in the Linux kernel before 2.6.28-rc1 might allow local users to have an unknown impact via a certain /dev/watchdog WDIOC_SETTIMEOUT IOCTL call.
ImportantCVE-2008-5702SUSE bug 457898cpe:/o:suse:suse-microos:5.0CVE-2009-0024SUSE Linux Enterprise Micro 5.0
The sys_remap_file_pages function in mm/fremap.c in the Linux kernel before 2.6.24.1 allows local users to cause a denial of service or gain privileges via unspecified vectors, related to the vm_file structure member, and the mmap_region and do_munmap functions.
ImportantCVE-2009-0024SUSE bug 464050cpe:/o:suse:suse-microos:5.0CVE-2009-0029SUSE Linux Enterprise Micro 5.0
The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service (crash) or possibly gain privileges via a crafted system call.
ImportantCVE-2009-0029SUSE bug 466015cpe:/o:suse:suse-microos:5.0CVE-2009-0065SUSE Linux Enterprise Micro 5.0
Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.28-git8 allows remote attackers to have an unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk with a large stream ID.
CriticalCVE-2009-0065SUSE bug 463522cpe:/o:suse:suse-microos:5.0CVE-2009-0269SUSE Linux Enterprise Micro 5.0
fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28.1 allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array index.
ModerateCVE-2009-0269SUSE bug 470942cpe:/o:suse:suse-microos:5.0CVE-2009-0316SUSE Linux Enterprise Micro 5.0
Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.
ModerateCVE-2009-0316SUSE bug 470100cpe:/o:suse:suse-microos:5.0CVE-2009-0322SUSE Linux Enterprise Micro 5.0
drivers/firmware/dell_rbu.c in the Linux kernel before 2.6.27.13, and 2.6.28.x before 2.6.28.2, allows local users to cause a denial of service (system crash) via a read system call that specifies zero bytes from the (1) image_type or (2) packet_size file in /sys/devices/platform/dell_rbu/.
ModerateCVE-2009-0322SUSE bug 470943cpe:/o:suse:suse-microos:5.0CVE-2009-0342SUSE Linux Enterprise Micro 5.0
Niels Provos Systrace before 1.6f on the x86_64 Linux platform allows local users to bypass intended access restrictions by making a 64-bit syscall with a syscall number that corresponds to a policy-compliant 32-bit syscall.
ImportantCVE-2009-0342SUSE bug 483819SUSE bug 483820cpe:/o:suse:suse-microos:5.0CVE-2009-0676SUSE Linux Enterprise Micro 5.0
The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request.
LowCVE-2009-0676SUSE bug 478002cpe:/o:suse:suse-microos:5.0CVE-2009-0745SUSE Linux Enterprise Micro 5.0
The ext4_group_add function in fs/ext4/resize.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not properly initialize the group descriptor during a resize (aka resize2fs) operation, which might allow local users to cause a denial of service (OOPS) by arranging for crafted values to be present in available memory.
ModerateCVE-2009-0745SUSE bug 480860cpe:/o:suse:suse-microos:5.0CVE-2009-0778SUSE Linux Enterprise Micro 5.0
The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25, when configured as a router with a REJECT route, does not properly manage the Protocol Independent Destination Cache (aka DST) in some situations involving transmission of an ICMP Host Unreachable message, which allows remote attackers to cause a denial of service (connectivity outage) by sending a large series of packets to many destination IP addresses within this REJECT route, related to an "rt_cache leak."
ImportantCVE-2009-0778SUSE bug 482712cpe:/o:suse:suse-microos:5.0CVE-2009-0787SUSE Linux Enterprise Micro 5.0
The ecryptfs_write_metadata_to_contents function in the eCryptfs functionality in the Linux kernel 2.6.28 before 2.6.28.9 uses an incorrect size when writing kernel memory to an eCryptfs file header, which triggers an out-of-bounds read and allows local users to obtain portions of kernel memory.
ModerateCVE-2009-0787SUSE bug 487107cpe:/o:suse:suse-microos:5.0CVE-2009-0834SUSE Linux Enterprise Micro 5.0
The audit_syscall_entry function in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls, a related issue to CVE-2009-0342 and CVE-2009-0343.
ImportantCVE-2009-0834SUSE bug 483819SUSE bug 483820cpe:/o:suse:suse-microos:5.0CVE-2009-0835SUSE Linux Enterprise Micro 5.0
The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform, when CONFIG_SECCOMP is enabled, does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass intended access restrictions via crafted syscalls that are misinterpreted as (a) stat or (b) chmod, a related issue to CVE-2009-0342 and CVE-2009-0343.
ImportantCVE-2009-0835SUSE bug 483819SUSE bug 483820cpe:/o:suse:suse-microos:5.0CVE-2009-0935SUSE Linux Enterprise Micro 5.0
The inotify_read function in the Linux kernel 2.6.27 to 2.6.27.13, 2.6.28 to 2.6.28.2, and 2.6.29-rc3 allows local users to cause a denial of service (OOPS) via a read with an invalid address to an inotify instance, which causes the device's event list mutex to be unlocked twice and prevents proper synchronization of a data structure for the inotify instance.
ModerateCVE-2009-0935SUSE bug 482843cpe:/o:suse:suse-microos:5.0CVE-2009-1046SUSE Linux Enterprise Micro 5.0
The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters, which triggers an "off-by-two memory error." NOTE: it is not clear whether this issue crosses privilege boundaries.
ModerateCVE-2009-1046SUSE bug 478699cpe:/o:suse:suse-microos:5.0CVE-2009-1072SUSE Linux Enterprise Micro 5.0
nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.
ModerateCVE-2009-1072SUSE bug 487681SUSE bug 497551cpe:/o:suse:suse-microos:5.0CVE-2009-1185SUSE Linux Enterprise Micro 5.0
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.
ImportantCVE-2009-1185SUSE bug 1034330SUSE bug 493158SUSE bug 550249SUSE bug 776925cpe:/o:suse:suse-microos:5.0CVE-2009-1192SUSE Linux Enterprise Micro 5.0
The (1) agp_generic_alloc_page and (2) agp_generic_alloc_pages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux kernel before 2.6.30-rc3 do not zero out pages that may later be available to a user-space process, which allows local users to obtain sensitive information by reading these pages.
ModerateCVE-2009-1192SUSE bug 497159cpe:/o:suse:suse-microos:5.0CVE-2009-1242SUSE Linux Enterprise Micro 5.0
The vmx_set_msr function in arch/x86/kvm/vmx.c in the VMX implementation in the KVM subsystem in the Linux kernel before 2.6.29.1 on the i386 platform allows guest OS users to cause a denial of service (OOPS) by setting the EFER_LME (aka "Long mode enable") bit in the Extended Feature Enable Register (EFER) model-specific register, which is specific to the x86_64 platform.
ModerateCVE-2009-1242SUSE bug 492760cpe:/o:suse:suse-microos:5.0CVE-2009-1336SUSE Linux Enterprise Micro 5.0
fs/nfs/client.c in the Linux kernel before 2.6.23 does not properly initialize a certain structure member that stores the maximum NFS filename length, which allows local users to cause a denial of service (OOPS) via a long filename, related to the encode_lookup function.
ModerateCVE-2009-1336SUSE bug 492766cpe:/o:suse:suse-microos:5.0CVE-2009-1337SUSE Linux Enterprise Micro 5.0
The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.
ModerateCVE-2009-1337SUSE bug 1171985SUSE bug 492768cpe:/o:suse:suse-microos:5.0CVE-2009-1385SUSE Linux Enterprise Micro 5.0
Integer underflow in the e1000_clean_rx_irq function in drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel before 2.6.30-rc8, the e1000e driver in the Linux kernel, and Intel Wired Ethernet (aka e1000) before 7.5.5 allows remote attackers to cause a denial of service (panic) via a crafted frame size.
ImportantCVE-2009-1385SUSE bug 509822SUSE bug 567376SUSE bug 567678cpe:/o:suse:suse-microos:5.0CVE-2009-1389SUSE Linux Enterprise Micro 5.0
Buffer overflow in the RTL8169 NIC driver (drivers/net/r8169.c) in the Linux kernel before 2.6.30 allows remote attackers to cause a denial of service (kernel memory corruption and crash) via a long packet.
ImportantCVE-2009-1389SUSE bug 511243SUSE bug 567376SUSE bug 567678cpe:/o:suse:suse-microos:5.0CVE-2009-1439SUSE Linux Enterprise Micro 5.0
Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.
ImportantCVE-2009-1439SUSE bug 492282SUSE bug 498824cpe:/o:suse:suse-microos:5.0CVE-2009-1630SUSE Linux Enterprise Micro 5.0
The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.
ModerateCVE-2009-1630SUSE bug 1175689SUSE bug 503353cpe:/o:suse:suse-microos:5.0CVE-2009-1633SUSE Linux Enterprise Micro 5.0
Multiple buffer overflows in the cifs subsystem in the Linux kernel before 2.6.29.4 allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess.c; or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c.
ImportantCVE-2009-1633SUSE bug 492282SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2009-1883SUSE Linux Enterprise Micro 5.0
The z90crypt_unlocked_ioctl function in the z90crypt driver in the Linux kernel 2.6.9 does not perform a capability check for the Z90QUIESCE operation, which allows local users to leverage euid 0 privileges to force a driver outage.
ModerateCVE-2009-1883SUSE bug 539879cpe:/o:suse:suse-microos:5.0CVE-2009-1895SUSE Linux Enterprise Micro 5.0
The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR).
ImportantCVE-2009-1895SUSE bug 521427SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2009-1961SUSE Linux Enterprise Micro 5.0
The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions.
LowCVE-2009-1961SUSE bug 495065cpe:/o:suse:suse-microos:5.0CVE-2009-2406SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size.
ModerateCVE-2009-2406SUSE bug 523719SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2009-2407SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the parse_tag_3_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to a large encrypted key size in a Tag 3 packet.
ModerateCVE-2009-2407SUSE bug 523719SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2009-2691SUSE Linux Enterprise Micro 5.0
The mm_for_maps function in fs/proc/base.c in the Linux kernel 2.6.30.4 and earlier allows local users to read (1) maps and (2) smaps files under proc/ via vectors related to ELF loading, a setuid process, and a race condition.
ModerateCVE-2009-2691SUSE bug 529919cpe:/o:suse:suse-microos:5.0CVE-2009-2698SUSE Linux Enterprise Micro 5.0
The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.
ImportantCVE-2009-2698SUSE bug 532338cpe:/o:suse:suse-microos:5.0CVE-2009-2767SUSE Linux Enterprise Micro 5.0
The init_posix_timers function in kernel/posix-timers.c in the Linux kernel before 2.6.31-rc6 allows local users to cause a denial of service (OOPS) or possibly gain privileges via a CLOCK_MONOTONIC_RAW clock_nanosleep call that triggers a NULL pointer dereference.
ImportantCVE-2009-2767SUSE bug 529555cpe:/o:suse:suse-microos:5.0CVE-2009-2848SUSE Linux Enterprise Micro 5.0
The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.
ModerateCVE-2009-2848SUSE bug 527865cpe:/o:suse:suse-microos:5.0CVE-2009-2903SUSE Linux Enterprise Micro 5.0
Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams.
ImportantCVE-2009-2903SUSE bug 539878cpe:/o:suse:suse-microos:5.0CVE-2009-2908SUSE Linux Enterprise Micro 5.0
The d_delete function in fs/ecryptfs/inode.c in eCryptfs in the Linux kernel 2.6.31 allows local users to cause a denial of service (kernel OOPS) and possibly execute arbitrary code via unspecified vectors that cause a "negative dentry" and trigger a NULL pointer dereference, as demonstrated via a Mutt temporary directory in an eCryptfs mount.
ModerateCVE-2009-2908SUSE bug 545274cpe:/o:suse:suse-microos:5.0CVE-2009-2910SUSE Linux Enterprise Micro 5.0
arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.31.4 on the x86_64 platform does not clear certain kernel registers before a return to user mode, which allows local users to read register values from an earlier process by switching an ia32 process to 64-bit mode.
LowCVE-2009-2910SUSE bug 1175785SUSE bug 543740cpe:/o:suse:suse-microos:5.0CVE-2009-3228SUSE Linux Enterprise Micro 5.0
The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.
LowCVE-2009-3228SUSE bug 1175788SUSE bug 536467cpe:/o:suse:suse-microos:5.0CVE-2009-3286SUSE Linux Enterprise Micro 5.0
NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does not properly clean up an inode when an O_EXCL create fails, which causes files to be created with insecure settings such as setuid bits, and possibly allows local users to gain privileges, related to the execution of the do_open_permission function even when a create fails.
ModerateCVE-2009-3286SUSE bug 541648cpe:/o:suse:suse-microos:5.0CVE-2009-3297SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-0787, CVE-2010-0788, CVE-2010-0789. Reason: this candidate was intended for one issue in Samba, but it was used for multiple distinct issues, including one in FUSE and one in ncpfs. Notes: All CVE users should consult CVE-2010-0787 (Samba), CVE-2010-0788 (ncpfs), and CVE-2010-0789 (FUSE) to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.
LowCVE-2009-3297SUSE bug 550002SUSE bug 550003SUSE bug 550004SUSE bug 577925SUSE bug 583535SUSE bug 583536SUSE bug 594263SUSE bug 620680SUSE bug 651598cpe:/o:suse:suse-microos:5.0CVE-2009-3379SUSE Linux Enterprise Micro 5.0
Multiple unspecified vulnerabilities in libvorbis, as used in Mozilla Firefox 3.5.x before 3.5.4, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors. NOTE: this might overlap CVE-2009-2663.
CriticalCVE-2009-3379SUSE bug 522109SUSE bug 545277SUSE bug 608192cpe:/o:suse:suse-microos:5.0CVE-2009-3547SUSE Linux Enterprise Micro 5.0
Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.
ImportantCVE-2009-3547SUSE bug 550001cpe:/o:suse:suse-microos:5.0CVE-2009-3556SUSE Linux Enterprise Micro 5.0
A certain Red Hat configuration step for the qla2xxx driver in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when N_Port ID Virtualization (NPIV) hardware is used, sets world-writable permissions for the (1) vport_create and (2) vport_delete files under /sys/class/scsi_host/, which allows local users to make arbitrary changes to SCSI host attributes by modifying these files.
LowCVE-2009-3556SUSE bug 572193SUSE bug 605463cpe:/o:suse:suse-microos:5.0CVE-2009-3559SUSE Linux Enterprise Micro 5.0
** DISPUTED ** main/streams/plain_wrapper.c in PHP 5.3.x before 5.3.1 does not recognize the safe_mode_include_dir directive, which allows context-dependent attackers to have an unknown impact by triggering the failure of PHP scripts that perform include or require operations, as demonstrated by a script that attempts to perform a require_once on a file in a standard library directory. NOTE: a reliable third party reports that this is not a vulnerability, because it results in a more restrictive security policy.
ImportantCVE-2009-3559SUSE bug 557157SUSE bug 992991cpe:/o:suse:suse-microos:5.0CVE-2009-3612SUSE Linux Enterprise Micro 5.0
The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2005-4881.
LowCVE-2009-3612SUSE bug 536467cpe:/o:suse:suse-microos:5.0CVE-2009-3620SUSE Linux Enterprise Micro 5.0
The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.
ModerateCVE-2009-3620SUSE bug 548071cpe:/o:suse:suse-microos:5.0CVE-2009-3621SUSE Linux Enterprise Micro 5.0
net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket.
ModerateCVE-2009-3621SUSE bug 548070cpe:/o:suse:suse-microos:5.0CVE-2009-3623SUSE Linux Enterprise Micro 5.0
The lookup_cb_cred function in fs/nfsd/nfs4callback.c in the nfsd4 subsystem in the Linux kernel before 2.6.31.2 attempts to access a credentials cache even when a client specifies the AUTH_NULL authentication flavor, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an NFSv4 mount request.
ImportantCVE-2009-3623SUSE bug 549029cpe:/o:suse:suse-microos:5.0CVE-2009-3624SUSE Linux Enterprise Micro 5.0
The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands.
ModerateCVE-2009-3624SUSE bug 549030cpe:/o:suse:suse-microos:5.0CVE-2009-3638SUSE Linux Enterprise Micro 5.0
Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.31.4 allows local users to have an unspecified impact via a KVM_GET_SUPPORTED_CPUID request to the kvm_arch_dev_ioctl function.
ImportantCVE-2009-3638SUSE bug 550072cpe:/o:suse:suse-microos:5.0CVE-2009-3640SUSE Linux Enterprise Micro 5.0
The update_cr8_intercept function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc1 does not properly handle the absence of an Advanced Programmable Interrupt Controller (APIC), which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via a call to the kvm_vcpu_ioctl function.
ModerateCVE-2009-3640SUSE bug 549487cpe:/o:suse:suse-microos:5.0CVE-2009-3889SUSE Linux Enterprise Micro 5.0
The dbg_lvl file for the megaraid_sas driver in the Linux kernel before 2.6.27 has world-writable permissions, which allows local users to change the (1) behavior and (2) logging level of the driver by modifying this file.
ModerateCVE-2009-3889SUSE bug 555173SUSE bug 557180cpe:/o:suse:suse-microos:5.0CVE-2009-3939SUSE Linux Enterprise Micro 5.0
The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.
ModerateCVE-2009-3939SUSE bug 555173SUSE bug 557180cpe:/o:suse:suse-microos:5.0CVE-2009-4012SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in LibThai before 0.1.13 might allow context-dependent attackers to execute arbitrary code via long strings that trigger heap-based buffer overflows, related to (1) thbrk/thbrk.c and (2) thwbrk/thwbrk.c. NOTE: some of these details are obtained from third party information.
CriticalCVE-2009-4012SUSE bug 569615cpe:/o:suse:suse-microos:5.0CVE-2009-4020SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the hfs subsystem in the Linux kernel 2.6.32 allows remote attackers to have an unspecified impact via a crafted Hierarchical File System (HFS) filesystem, related to the hfs_readdir function in fs/hfs/dir.c.
ImportantCVE-2009-4020SUSE bug 564374SUSE bug 605463SUSE bug 760902cpe:/o:suse:suse-microos:5.0CVE-2009-4026SUSE Linux Enterprise Micro 5.0
The mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (panic) via a crafted Delete Block ACK (aka DELBA) packet, related to an erroneous "code shuffling patch."
ImportantCVE-2009-4026SUSE bug 558267cpe:/o:suse:suse-microos:5.0CVE-2009-4027SUSE Linux Enterprise Micro 5.0
Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that triggers a certain state change in the absence of an aggregation session.
ImportantCVE-2009-4027SUSE bug 558267cpe:/o:suse:suse-microos:5.0CVE-2009-4031SUSE Linux Enterprise Micro 5.0
The do_insn_fetch function in arch/x86/kvm/emulate.c in the x86 emulator in the KVM subsystem in the Linux kernel before 2.6.32-rc8-next-20091125 tries to interpret instructions that contain too many bytes to be valid, which allows guest OS users to cause a denial of service (increased scheduling latency) on the host OS via unspecified manipulations related to SMP support.
ImportantCVE-2009-4031SUSE bug 558269SUSE bug 558662cpe:/o:suse:suse-microos:5.0CVE-2009-4067SUSE Linux Enterprise Micro 5.0
Buffer overflow in the auerswald_probe function in the Auerswald Linux USB driver for the Linux kernel before 2.6.27 allows physically proximate attackers to execute arbitrary code, cause a denial of service via a crafted USB device, or take full control of the system.
LowCVE-2009-4067SUSE bug 706375cpe:/o:suse:suse-microos:5.0CVE-2009-4131SUSE Linux Enterprise Micro 5.0
The EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel before 2.6.32-git6 allows local users to overwrite arbitrary files via a crafted request, related to insufficient checks for file permissions.
ImportantCVE-2009-4131SUSE bug 561018SUSE bug 564380cpe:/o:suse:suse-microos:5.0CVE-2009-4138SUSE Linux Enterprise Micro 5.0
drivers/firewire/ohci.c in the Linux kernel before 2.6.32-git9, when packet-per-buffer mode is used, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unknown other impact via an unspecified ioctl associated with receiving an ISO packet that contains zero in the payload-length field.
ModerateCVE-2009-4138SUSE bug 564712cpe:/o:suse:suse-microos:5.0CVE-2009-4306SUSE Linux Enterprise Micro 5.0
Unspecified vulnerability in the EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel 2.6.32-git6 and earlier allows local users to cause a denial of service (filesystem corruption) via unknown vectors, a different vulnerability than CVE-2009-4131.
ModerateCVE-2009-4306SUSE bug 564380cpe:/o:suse:suse-microos:5.0CVE-2009-4307SUSE Linux Enterprise Micro 5.0
The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).
ImportantCVE-2009-4307SUSE bug 564381SUSE bug 757278cpe:/o:suse:suse-microos:5.0CVE-2009-4308SUSE Linux Enterprise Micro 5.0
The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal.
ImportantCVE-2009-4308SUSE bug 564382cpe:/o:suse:suse-microos:5.0CVE-2009-4536SUSE Linux Enterprise Micro 5.0
drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1385.
ImportantCVE-2009-4536SUSE bug 567376SUSE bug 583434cpe:/o:suse:suse-microos:5.0CVE-2009-4537SUSE Linux Enterprise Micro 5.0
drivers/net/r8169.c in the r8169 driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters, related to the value of the status register and erroneous behavior associated with the RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389.
ImportantCVE-2009-4537SUSE bug 567376cpe:/o:suse:suse-microos:5.0CVE-2009-4538SUSE Linux Enterprise Micro 5.0
drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537.
CriticalCVE-2009-4538SUSE bug 567376cpe:/o:suse:suse-microos:5.0CVE-2009-5155SUSE Linux Enterprise Micro 5.0
In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.
LowCVE-2009-5155SUSE bug 1127223cpe:/o:suse:suse-microos:5.0CVE-2010-0003SUSE Linux Enterprise Micro 5.0
The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386 platform, when print-fatal-signals is enabled, allows local users to discover the contents of arbitrary memory locations by jumping to an address and then reading a log file, and might allow local users to cause a denial of service (system slowdown or crash) by jumping to an address.
ModerateCVE-2010-0003SUSE bug 569902cpe:/o:suse:suse-microos:5.0CVE-2010-0006SUSE Linux Enterprise Micro 5.0
The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.32.4, when network namespaces are enabled, allows remote attackers to cause a denial of service (NULL pointer dereference) via an invalid IPv6 jumbogram, a related issue to CVE-2007-4567.
ImportantCVE-2010-0006SUSE bug 570608cpe:/o:suse:suse-microos:5.0CVE-2010-0007SUSE Linux Enterprise Micro 5.0
net/bridge/netfilter/ebtables.c in the ebtables module in the netfilter framework in the Linux kernel before 2.6.33-rc4 does not require the CAP_NET_ADMIN capability for setting or modifying rules, which allows local users to bypass intended access restrictions and configure arbitrary network-traffic filtering via a modified ebtables application.
ModerateCVE-2010-0007SUSE bug 570602SUSE bug 570606cpe:/o:suse:suse-microos:5.0CVE-2010-0008SUSE Linux Enterprise Micro 5.0
The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.
ImportantCVE-2010-0008SUSE bug 586195cpe:/o:suse:suse-microos:5.0CVE-2010-0307SUSE Linux Enterprise Micro 5.0
The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro, which allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to execute a 64-bit application and then triggers a segmentation fault, as demonstrated by amd64_killer, related to the flush_old_exec function.
ModerateCVE-2010-0307SUSE bug 575644cpe:/o:suse:suse-microos:5.0CVE-2010-0410SUSE Linux Enterprise Micro 5.0
drivers/connector/connector.c in the Linux kernel before 2.6.32.8 allows local users to cause a denial of service (memory consumption and system crash) by sending the kernel many NETLINK_CONNECTOR messages.
ModerateCVE-2010-0410SUSE bug 576927SUSE bug 605463cpe:/o:suse:suse-microos:5.0CVE-2010-0415SUSE Linux Enterprise Micro 5.0
The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel's node set.
ModerateCVE-2010-0415SUSE bug 577753cpe:/o:suse:suse-microos:5.0CVE-2010-0623SUSE Linux Enterprise Micro 5.0
The futex_lock_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly manage a certain reference count, which allows local users to cause a denial of service (OOPS) via vectors involving an unmount of an ext3 filesystem.
ModerateCVE-2010-0623SUSE bug 579439cpe:/o:suse:suse-microos:5.0CVE-2010-0624SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functionality in GNU tar before 1.23 and GNU cpio before 2.11 allows remote rmt servers to cause a denial of service (memory corruption) or possibly execute arbitrary code by sending more data than was requested, related to archive filenames that contain a : (colon) character.
ModerateCVE-2010-0624SUSE bug 579475SUSE bug 608034cpe:/o:suse:suse-microos:5.0CVE-2010-0730SUSE Linux Enterprise Micro 5.0
The MMIO instruction decoder in the Xen hypervisor in the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows guest OS users to cause a denial of service (32-bit guest OS crash) via vectors that trigger an unspecified instruction emulation.
LowCVE-2010-0730SUSE bug 601231cpe:/o:suse:suse-microos:5.0CVE-2010-0741SUSE Linux Enterprise Micro 5.0
The virtio_net_bad_features function in hw/virtio-net.c in the virtio-net driver in the Linux kernel before 2.6.26, when used on a guest OS in conjunction with qemu-kvm 0.11.0 or KVM 83, allows remote attackers to cause a denial of service (guest OS crash, and an associated qemu-kvm process exit) by sending a large amount of network traffic to a TCP port on the guest OS, related to a virtio-net whitelist that includes an improper implementation of TCP Segment Offloading (TSO).
ImportantCVE-2010-0741SUSE bug 596032cpe:/o:suse:suse-microos:5.0CVE-2010-1148SUSE Linux Enterprise Micro 5.0
The cifs_create function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a NULL nameidata (aka nd) field in a POSIX file-creation request to a server that supports UNIX extensions.
ModerateCVE-2010-1148SUSE bug 593940cpe:/o:suse:suse-microos:5.0CVE-2010-1162SUSE Linux Enterprise Micro 5.0
The release_one_tty function in drivers/char/tty_io.c in the Linux kernel before 2.6.34-rc4 omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors.
ImportantCVE-2010-1162SUSE bug 596462cpe:/o:suse:suse-microos:5.0CVE-2010-1172SUSE Linux Enterprise Micro 5.0
DBus-GLib 0.73 disregards the access flag of exported GObject properties, which allows local users to bypass intended access restrictions and possibly cause a denial of service by modifying properties, as demonstrated by properties of the (1) DeviceKit-Power, (2) NetworkManager, and (3) ModemManager services.
ModerateCVE-2010-1172SUSE bug 628607SUSE bug 633621SUSE bug 633622SUSE bug 633623SUSE bug 633629SUSE bug 633637SUSE bug 633639SUSE bug 633648SUSE bug 633652SUSE bug 633653SUSE bug 633654SUSE bug 633658SUSE bug 633660SUSE bug 633678SUSE bug 633679SUSE bug 633681SUSE bug 633682SUSE bug 633685SUSE bug 633686SUSE bug 633700SUSE bug 633701SUSE bug 633702cpe:/o:suse:suse-microos:5.0CVE-2010-1173SUSE Linux Enterprise Micro 5.0
The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data.
ImportantCVE-2010-1173SUSE bug 600375SUSE bug 702025SUSE bug 941110cpe:/o:suse:suse-microos:5.0CVE-2010-1188SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state, which is not properly handled and causes the skb structure to be freed.
ImportantCVE-2010-1188SUSE bug 592571cpe:/o:suse:suse-microos:5.0CVE-2010-1436SUSE Linux Enterprise Micro 5.0
gfs2 in the Linux kernel 2.6.18, and possibly other versions, does not properly handle when the gfs2_quota struct occupies two separate pages, which allows local users to cause a denial of service (kernel panic) via certain manipulations that cause an out-of-bounds write, as demonstrated by writing from an ext3 file system to a gfs2 file system.
ModerateCVE-2010-1436SUSE bug 599957cpe:/o:suse:suse-microos:5.0CVE-2010-1437SUSE Linux Enterprise Micro 5.0
Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.
LowCVE-2010-1437SUSE bug 599955cpe:/o:suse:suse-microos:5.0CVE-2010-1636SUSE Linux Enterprise Micro 5.0
The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the btrfs functionality in the Linux kernel 2.6.29 through 2.6.32, and possibly other versions, does not ensure that a cloned file descriptor has been opened for reading, which allows local users to read sensitive information from a write-only file descriptor.
ModerateCVE-2010-1636SUSE bug 606743cpe:/o:suse:suse-microos:5.0CVE-2010-1641SUSE Linux Enterprise Micro 5.0
The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel before 2.6.34-git10 does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS ioctl request.
ModerateCVE-2010-1641SUSE bug 608576cpe:/o:suse:suse-microos:5.0CVE-2010-1643SUSE Linux Enterprise Micro 5.0
mm/shmem.c in the Linux kernel before 2.6.28-rc3, when strict overcommit is enabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors.
ModerateCVE-2010-1643SUSE bug 608933cpe:/o:suse:suse-microos:5.0CVE-2010-1646SUSE Linux Enterprise Micro 5.0
The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.
ModerateCVE-2010-1646SUSE bug 594738cpe:/o:suse:suse-microos:5.0CVE-2010-2066SUSE Linux Enterprise Micro 5.0
The mext_check_arguments function in fs/ext4/move_extent.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a MOVE_EXT ioctl call that specifies this file as a donor.
ModerateCVE-2010-2066SUSE bug 612457cpe:/o:suse:suse-microos:5.0CVE-2010-2226SUSE Linux Enterprise Micro 5.0
The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.
ModerateCVE-2010-2226SUSE bug 615141cpe:/o:suse:suse-microos:5.0CVE-2010-2240SUSE Linux Enterprise Micro 5.0
The do_anonymous_page function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the heap, which allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment, as demonstrated by a memory-exhaustion attack against the X.Org X server.
ImportantCVE-2010-2240SUSE bug 1039348SUSE bug 211997SUSE bug 546062SUSE bug 59807SUSE bug 615929SUSE bug 618152SUSE bug 632737SUSE bug 643986SUSE bug 746947SUSE bug 746949cpe:/o:suse:suse-microos:5.0CVE-2010-2243SUSE Linux Enterprise Micro 5.0
A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.34 where on non-GENERIC_TIME systems (GENERIC_TIME=n), accessing /sys/devices/system/clocksource/clocksource0/current_clocksource results in an OOPS.
ImportantCVE-2010-2243SUSE bug 617903cpe:/o:suse:suse-microos:5.0CVE-2010-2248SUSE Linux Enterprise Micro 5.0
fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel before 2.6.34-rc4 allows remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions.
ImportantCVE-2010-2248SUSE bug 618156cpe:/o:suse:suse-microos:5.0CVE-2010-2492SUSE Linux Enterprise Micro 5.0
Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.
ImportantCVE-2010-2492SUSE bug 619850cpe:/o:suse:suse-microos:5.0CVE-2010-2495SUSE Linux Enterprise Micro 5.0
The pppol2tp_xmit function in drivers/net/pppol2tp.c in the L2TP implementation in the Linux kernel before 2.6.34 does not properly validate certain values associated with an interface, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via vectors related to a routing change.
CriticalCVE-2010-2495SUSE bug 616612cpe:/o:suse:suse-microos:5.0CVE-2010-2521SUSE Linux Enterprise Micro 5.0
Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.
CriticalCVE-2010-2521SUSE bug 620372cpe:/o:suse:suse-microos:5.0CVE-2010-2524SUSE Linux Enterprise Micro 5.0
The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's keyring for the dns_resolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform arbitrary CIFS mounts via vectors involving an add_key call, related to a "cache stuffing" issue and MS-DFS referrals.
ImportantCVE-2010-2524SUSE bug 627386SUSE bug 627447cpe:/o:suse:suse-microos:5.0CVE-2010-2537SUSE Linux Enterprise Micro 5.0
The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1) BTRFS_IOC_CLONE or (2) BTRFS_IOC_CLONE_RANGE ioctl call that specifies this file as a donor.
ImportantCVE-2010-2537SUSE bug 624587cpe:/o:suse:suse-microos:5.0CVE-2010-2798SUSE Linux Enterprise Micro 5.0
The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact by renaming a file in a GFS2 filesystem, related to the gfs2_rename function in fs/gfs2/ops_inode.c.
ImportantCVE-2010-2798SUSE bug 627386cpe:/o:suse:suse-microos:5.0CVE-2010-2803SUSE Linux Enterprise Micro 5.0
The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount.
ImportantCVE-2010-2803SUSE bug 628604cpe:/o:suse:suse-microos:5.0CVE-2010-2942SUSE Linux Enterprise Micro 5.0
The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory via vectors related to (1) the tcf_gact_dump function in net/sched/act_gact.c, (2) the tcf_mirred_dump function in net/sched/act_mirred.c, (3) the tcf_nat_dump function in net/sched/act_nat.c, (4) the tcf_simp_dump function in net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in net/sched/act_skbedit.c.
ModerateCVE-2010-2942SUSE bug 632309SUSE bug 642324cpe:/o:suse:suse-microos:5.0CVE-2010-2943SUSE Linux Enterprise Micro 5.0
The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.
ImportantCVE-2010-2943SUSE bug 632317cpe:/o:suse:suse-microos:5.0CVE-2010-2946SUSE Linux Enterprise Micro 5.0
fs/jfs/xattr.c in the Linux kernel before 2.6.35.2 does not properly handle a certain legacy format for storage of extended attributes, which might allow local users by bypass intended xattr namespace restrictions via an "os2." substring at the beginning of a name.
ModerateCVE-2010-2946SUSE bug 633585cpe:/o:suse:suse-microos:5.0CVE-2010-2954SUSE Linux Enterprise Micro 5.0
The irda_bind function in net/irda/af_irda.c in the Linux kernel before 2.6.36-rc3-next-20100901 does not properly handle failure of the irda_open_tsap function, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact via multiple unsuccessful calls to bind on an AF_IRDA (aka PF_IRDA) socket.
ModerateCVE-2010-2954SUSE bug 636112cpe:/o:suse:suse-microos:5.0CVE-2010-3066SUSE Linux Enterprise Micro 5.0
The io_submit_one function in fs/aio.c in the Linux kernel before 2.6.23 allows local users to cause a denial of service (NULL pointer dereference) via a crafted io_submit system call with an IOCB_FLAG_RESFD flag.
ModerateCVE-2010-3066SUSE bug 657944cpe:/o:suse:suse-microos:5.0CVE-2010-3067SUSE Linux Enterprise Micro 5.0
Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call.
ModerateCVE-2010-3067SUSE bug 642302cpe:/o:suse:suse-microos:5.0CVE-2010-3078SUSE Linux Enterprise Micro 5.0
The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an ioctl call.
ModerateCVE-2010-3078SUSE bug 637436cpe:/o:suse:suse-microos:5.0CVE-2010-3079SUSE Linux Enterprise Micro 5.0
kernel/trace/ftrace.c in the Linux kernel before 2.6.35.5, when debugfs is enabled, does not properly handle interaction between mutex possession and llseek operations, which allows local users to cause a denial of service (NULL pointer dereference and outage of all function tracing files) via an lseek call on a file descriptor associated with the set_ftrace_filter file.
ModerateCVE-2010-3079SUSE bug 637502cpe:/o:suse:suse-microos:5.0CVE-2010-3080SUSE Linux Enterprise Micro 5.0
Double free vulnerability in the snd_seq_oss_open function in sound/core/seq/oss/seq_oss_init.c in the Linux kernel before 2.6.36-rc4 might allow local users to cause a denial of service or possibly have unspecified other impact via an unsuccessful attempt to open the /dev/sequencer device.
ImportantCVE-2010-3080SUSE bug 638277cpe:/o:suse:suse-microos:5.0CVE-2010-3081SUSE Linux Enterprise Micro 5.0
The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
ImportantCVE-2010-3081SUSE bug 639709SUSE bug 641575SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2010-3084SUSE Linux Enterprise Micro 5.0
Buffer overflow in the niu_get_ethtool_tcam_all function in drivers/net/niu.c in the Linux kernel before 2.6.36-rc4 allows local users to cause a denial of service or possibly have unspecified other impact via the ETHTOOL_GRXCLSRLALL ethtool command.
ImportantCVE-2010-3084SUSE bug 638274cpe:/o:suse:suse-microos:5.0CVE-2010-3086SUSE Linux Enterprise Micro 5.0
include/asm-x86/futex.h in the Linux kernel before 2.6.25 does not properly implement exception fixup, which allows local users to cause a denial of service (panic) via an invalid application that triggers a page fault.
ModerateCVE-2010-3086SUSE bug 652595cpe:/o:suse:suse-microos:5.0CVE-2010-3192SUSE Linux Enterprise Micro 5.0
Certain run-time memory protection mechanisms in the GNU C Library (aka glibc or libc6) print argv[0] and backtrace information, which might allow context-dependent attackers to obtain sensitive information from process memory by executing an incorrect program, as demonstrated by a setuid program that contains a stack-based buffer overflow error, related to the __fortify_fail function in debug/fortify_fail.c, and the __stack_chk_fail (aka stack protection) and __chk_fail (aka FORTIFY_SOURCE) implementations.
ModerateCVE-2010-3192SUSE bug 636113cpe:/o:suse:suse-microos:5.0CVE-2010-3296SUSE Linux Enterprise Micro 5.0
The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.
LowCVE-2010-3296SUSE bug 639481SUSE bug 649187cpe:/o:suse:suse-microos:5.0CVE-2010-3297SUSE Linux Enterprise Micro 5.0
The eql_g_master_cfg function in drivers/net/eql.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an EQL_GETMASTRCFG ioctl call.
LowCVE-2010-3297SUSE bug 639482SUSE bug 649187cpe:/o:suse:suse-microos:5.0CVE-2010-3298SUSE Linux Enterprise Micro 5.0
The hso_get_count function in drivers/net/usb/hso.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.
LowCVE-2010-3298SUSE bug 639483SUSE bug 649187cpe:/o:suse:suse-microos:5.0CVE-2010-3301SUSE Linux Enterprise Micro 5.0
The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register. NOTE: this vulnerability exists because of a CVE-2007-4573 regression.
ImportantCVE-2010-3301SUSE bug 639708cpe:/o:suse:suse-microos:5.0CVE-2010-3432SUSE Linux Enterprise Micro 5.0
The sctp_packet_config function in net/sctp/output.c in the Linux kernel before 2.6.35.6 performs extraneous initializations of packet data structures, which allows remote attackers to cause a denial of service (panic) via a certain sequence of SCTP traffic.
ImportantCVE-2010-3432SUSE bug 641983cpe:/o:suse:suse-microos:5.0CVE-2010-3437SUSE Linux Enterprise Micro 5.0
Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl call.
ModerateCVE-2010-3437SUSE bug 642486cpe:/o:suse:suse-microos:5.0CVE-2010-3442SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel before 2.6.36-rc5-next-20100929 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call.
ModerateCVE-2010-3442SUSE bug 642484cpe:/o:suse:suse-microos:5.0CVE-2010-3448SUSE Linux Enterprise Micro 5.0
drivers/platform/x86/thinkpad_acpi.c in the Linux kernel before 2.6.34 on ThinkPad devices, when the X.Org X server is used, does not properly restrict access to the video output control state, which allows local users to cause a denial of service (system hang) via a (1) read or (2) write operation.
ModerateCVE-2010-3448SUSE bug 662671cpe:/o:suse:suse-microos:5.0CVE-2010-3698SUSE Linux Enterprise Micro 5.0
The KVM implementation in the Linux kernel before 2.6.36 does not properly reload the FS and GS segment registers, which allows host OS users to cause a denial of service (host OS crash) via a KVM_RUN ioctl call in conjunction with a modified Local Descriptor Table (LDT).
ModerateCVE-2010-3698SUSE bug 1161450cpe:/o:suse:suse-microos:5.0CVE-2010-3705SUSE Linux Enterprise Micro 5.0
The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac_ids array of an SCTP peer, which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array.
ImportantCVE-2010-3705SUSE bug 643513cpe:/o:suse:suse-microos:5.0CVE-2010-3848SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to gain privileges by providing a large number of iovec structures.
ModerateCVE-2010-3848SUSE bug 647632cpe:/o:suse:suse-microos:5.0CVE-2010-3849SUSE Linux Enterprise Micro 5.0
The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a sendmsg call that specifies a NULL value for the remote address field.
ModerateCVE-2010-3849SUSE bug 647632cpe:/o:suse:suse-microos:5.0CVE-2010-3850SUSE Linux Enterprise Micro 5.0
The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2 does not require the CAP_NET_ADMIN capability, which allows local users to bypass intended access restrictions and configure econet addresses via an SIOCSIFADDR ioctl call.
ModerateCVE-2010-3850SUSE bug 647632SUSE bug 658461cpe:/o:suse:suse-microos:5.0CVE-2010-3858SUSE Linux Enterprise Micro 5.0
The setup_arg_pages function in fs/exec.c in the Linux kernel before 2.6.36, when CONFIG_STACK_GROWSDOWN is used, does not properly restrict the stack memory consumption of the (1) arguments and (2) environment for a 32-bit application on a 64-bit platform, which allows local users to cause a denial of service (system crash) via a crafted exec system call, a related issue to CVE-2010-2240.
ModerateCVE-2010-3858SUSE bug 648302SUSE bug 655220cpe:/o:suse:suse-microos:5.0CVE-2010-3861SUSE Linux Enterprise Micro 5.0
The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize a certain block of heap memory, which allows local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value, a different vulnerability than CVE-2010-2478.
LowCVE-2010-3861SUSE bug 649187cpe:/o:suse:suse-microos:5.0CVE-2010-3865SUSE Linux Enterprise Micro 5.0
Integer overflow in the rds_rdma_pages function in net/rds/rdma.c in the Linux kernel allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted iovec struct in a Reliable Datagram Sockets (RDS) request, which triggers a buffer overflow.
ImportantCVE-2010-3865SUSE bug 650128cpe:/o:suse:suse-microos:5.0CVE-2010-3873SUSE Linux Enterprise Micro 5.0
The X.25 implementation in the Linux kernel before 2.6.36.2 does not properly parse facilities, which allows remote attackers to cause a denial of service (heap memory corruption and panic) or possibly have unspecified other impact via malformed (1) X25_FAC_CALLING_AE or (2) X25_FAC_CALLED_AE data, related to net/x25/x25_facilities.c and net/x25/x25_in.c, a different vulnerability than CVE-2010-4164.
ModerateCVE-2010-3873SUSE bug 651219SUSE bug 653260cpe:/o:suse:suse-microos:5.0CVE-2010-3874SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.36.2 on 64-bit platforms might allow local users to cause a denial of service (memory corruption) via a connect operation.
LowCVE-2010-3874SUSE bug 651218cpe:/o:suse:suse-microos:5.0CVE-2010-3875SUSE Linux Enterprise Micro 5.0
The ax25_getname function in net/ax25/af_ax25.c in the Linux kernel before 2.6.37-rc2 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure.
ImportantCVE-2010-3875SUSE bug 650897cpe:/o:suse:suse-microos:5.0CVE-2010-3876SUSE Linux Enterprise Micro 5.0
net/packet/af_packet.c in the Linux kernel before 2.6.37-rc2 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_RAW capability to read copies of the applicable structures.
ImportantCVE-2010-3876SUSE bug 650897cpe:/o:suse:suse-microos:5.0CVE-2010-3877SUSE Linux Enterprise Micro 5.0
The get_name function in net/tipc/socket.c in the Linux kernel before 2.6.37-rc2 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure.
ImportantCVE-2010-3877SUSE bug 650897cpe:/o:suse:suse-microos:5.0CVE-2010-3880SUSE Linux Enterprise Micro 5.0
net/ipv4/inet_diag.c in the Linux kernel before 2.6.37-rc2 does not properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message that contains multiple attribute elements, as demonstrated by INET_DIAG_BC_JMP instructions.
ModerateCVE-2010-3880SUSE bug 651599cpe:/o:suse:suse-microos:5.0CVE-2010-3881SUSE Linux Enterprise Micro 5.0
arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device.
LowCVE-2010-3881SUSE bug 651596SUSE bug 662663SUSE bug 706696cpe:/o:suse:suse-microos:5.0CVE-2010-3904SUSE Linux Enterprise Micro 5.0
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
ImportantCVE-2010-3904SUSE bug 647392SUSE bug 676707SUSE bug 703752cpe:/o:suse:suse-microos:5.0CVE-2010-4078SUSE Linux Enterprise Micro 5.0
The sisfb_ioctl function in drivers/video/sis/sis_main.c in the Linux kernel before 2.6.36-rc6 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call.
LowCVE-2010-4078SUSE bug 642311cpe:/o:suse:suse-microos:5.0CVE-2010-4080SUSE Linux Enterprise Micro 5.0
The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call.
LowCVE-2010-4080SUSE bug 642312cpe:/o:suse:suse-microos:5.0CVE-2010-4081SUSE Linux Enterprise Micro 5.0
The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.
LowCVE-2010-4081SUSE bug 642312cpe:/o:suse:suse-microos:5.0CVE-2010-4158SUSE Linux Enterprise Micro 5.0
The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction, which allows local users to obtain potentially sensitive information from kernel stack memory via a crafted socket filter.
LowCVE-2010-4158SUSE bug 652563cpe:/o:suse:suse-microos:5.0CVE-2010-4160SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp.c, and the (2) l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the PPPoL2TP and IPoL2TP implementations in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (heap memory corruption and panic) or possibly gain privileges via a crafted sendto call.
ModerateCVE-2010-4160SUSE bug 652939cpe:/o:suse:suse-microos:5.0CVE-2010-4162SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in fs/bio.c in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (system crash) via a crafted device ioctl to a SCSI device.
ModerateCVE-2010-4162SUSE bug 652945cpe:/o:suse:suse-microos:5.0CVE-2010-4163SUSE Linux Enterprise Micro 5.0
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 2.6.36.2 allows local users to cause a denial of service (panic) via a zero-length I/O request in a device ioctl to a SCSI device.
ModerateCVE-2010-4163SUSE bug 652945SUSE bug 662202cpe:/o:suse:suse-microos:5.0CVE-2010-4165SUSE Linux Enterprise Micro 5.0
The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer.
ModerateCVE-2010-4165SUSE bug 653258cpe:/o:suse:suse-microos:5.0CVE-2010-4169SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in mm/mprotect.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors involving an mprotect system call.
ModerateCVE-2010-4169SUSE bug 653930cpe:/o:suse:suse-microos:5.0CVE-2010-4242SUSE Linux Enterprise Micro 5.0
The hci_uart_tty_open function in the HCI UART driver (drivers/bluetooth/hci_ldisc.c) in the Linux kernel 2.6.36, and possibly other versions, does not verify whether the tty has a write operation, which allows local users to cause a denial of service (NULL pointer dereference) via vectors related to the Bluetooth driver.
ModerateCVE-2010-4242SUSE bug 655451cpe:/o:suse:suse-microos:5.0CVE-2010-4243SUSE Linux Enterprise Micro 5.0
fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial of service (memory consumption) via a crafted exec system call, aka an "OOM dodging issue," a related issue to CVE-2010-3858.
ModerateCVE-2010-4243SUSE bug 655220SUSE bug 746947cpe:/o:suse:suse-microos:5.0CVE-2010-4248SUSE Linux Enterprise Micro 5.0
Race condition in the __exit_signal function in kernel/exit.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors related to multithreaded exec, the use of a thread group leader in kernel/posix-cpu-timers.c, and the selection of a new thread group leader in the de_thread function in fs/exec.c.
ModerateCVE-2010-4248SUSE bug 655468cpe:/o:suse:suse-microos:5.0CVE-2010-4249SUSE Linux Enterprise Micro 5.0
The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125 does not properly select times for garbage collection of inflight sockets, which allows local users to cause a denial of service (system hang) via crafted use of the socketpair and sendmsg system calls for SOCK_SEQPACKET sockets.
ModerateCVE-2010-4249SUSE bug 655696SUSE bug 656153cpe:/o:suse:suse-microos:5.0CVE-2010-4250SUSE Linux Enterprise Micro 5.0
Memory leak in the inotify_init1 function in fs/notify/inotify/inotify_user.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory consumption) via vectors involving failed attempts to create files.
ModerateCVE-2010-4250SUSE bug 655693cpe:/o:suse:suse-microos:5.0CVE-2010-4251SUSE Linux Enterprise Micro 5.0
The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service (memory consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests.
ImportantCVE-2010-4251SUSE bug 643138SUSE bug 655973SUSE bug 826455cpe:/o:suse:suse-microos:5.0CVE-2010-4256SUSE Linux Enterprise Micro 5.0
The pipe_fcntl function in fs/pipe.c in the Linux kernel before 2.6.37 does not properly determine whether a file is a named pipe, which allows local users to cause a denial of service via an F_SETPIPE_SZ fcntl call.
ModerateCVE-2010-4256SUSE bug 656483cpe:/o:suse:suse-microos:5.0CVE-2010-4258SUSE Linux Enterprise Micro 5.0
The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.
ImportantCVE-2010-4258SUSE bug 657350cpe:/o:suse:suse-microos:5.0CVE-2010-4263SUSE Linux Enterprise Micro 5.0
The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb) subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous mode are enabled but no VLANs are registered, allows remote attackers to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact via a VLAN tagged frame.
ImportantCVE-2010-4263SUSE bug 657716cpe:/o:suse:suse-microos:5.0CVE-2010-4342SUSE Linux Enterprise Micro 5.0
The aun_incoming function in net/econet/af_econet.c in the Linux kernel before 2.6.37-rc6, when Econet is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending an Acorn Universal Networking (AUN) packet over UDP.
ImportantCVE-2010-4342SUSE bug 658461cpe:/o:suse:suse-microos:5.0CVE-2010-4343SUSE Linux Enterprise Micro 5.0
drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.
ModerateCVE-2010-4343SUSE bug 658178cpe:/o:suse:suse-microos:5.0CVE-2010-4346SUSE Linux Enterprise Micro 5.0
The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.
ModerateCVE-2010-4346SUSE bug 658720cpe:/o:suse:suse-microos:5.0CVE-2010-4347SUSE Linux Enterprise Micro 5.0
The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which allows local users to gain privileges by placing a custom ACPI method in the ACPI interpreter tables, related to the acpi_debugfs_init function in drivers/acpi/debugfs.c.
ImportantCVE-2010-4347SUSE bug 659076cpe:/o:suse:suse-microos:5.0CVE-2010-4527SUSE Linux Enterprise Micro 5.0
The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel before 2.6.37 incorrectly expects that a certain name field ends with a '\0' character, which allows local users to conduct buffer overflow attacks and gain privileges, or possibly obtain sensitive information from kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call.
ModerateCVE-2010-4527SUSE bug 661945cpe:/o:suse:suse-microos:5.0CVE-2010-4565SUSE Linux Enterprise Micro 5.0
The bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel 2.6.36 and earlier creates a publicly accessible file with a filename containing a kernel memory address, which allows local users to obtain potentially sensitive information about kernel memory use by listing this filename.
LowCVE-2010-4565SUSE bug 1161355SUSE bug 651218cpe:/o:suse:suse-microos:5.0CVE-2010-4648SUSE Linux Enterprise Micro 5.0
The orinoco_ioctl_set_auth function in drivers/net/wireless/orinoco/wext.c in the Linux kernel before 2.6.37 does not properly implement a TKIP protection mechanism, which makes it easier for remote attackers to obtain access to a Wi-Fi network by reading Wi-Fi frames.
ModerateCVE-2010-4648SUSE bug 662951cpe:/o:suse:suse-microos:5.0CVE-2010-4649SUSE Linux Enterprise Micro 5.0
Integer overflow in the ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large value of a certain structure member.
ModerateCVE-2010-4649SUSE bug 662953SUSE bug 690537cpe:/o:suse:suse-microos:5.0CVE-2010-4805SUSE Linux Enterprise Micro 5.0
The socket implementation in net/core/sock.c in the Linux kernel before 2.6.35 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service by sending a large amount of network traffic, related to the sk_add_backlog function and the sk_rmem_alloc socket field. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4251.
ImportantCVE-2010-4805SUSE bug 698190cpe:/o:suse:suse-microos:5.0CVE-2010-5107SUSE Linux Enterprise Micro 5.0
The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.
ModerateCVE-2010-5107SUSE bug 1074631SUSE bug 802639SUSE bug 841638SUSE bug 858359SUSE bug 880259SUSE bug 881234SUSE bug 992991SUSE bug 996040cpe:/o:suse:suse-microos:5.0CVE-2010-5313SUSE Linux Enterprise Micro 5.0
Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842.
ModerateCVE-2010-5313SUSE bug 905312SUSE bug 907822cpe:/o:suse:suse-microos:5.0CVE-2010-5321SUSE Linux Enterprise Micro 5.0
Memory leak in drivers/media/video/videobuf-core.c in the videobuf subsystem in the Linux kernel 2.6.x through 4.x allows local users to cause a denial of service (memory consumption) by leveraging /dev/video access for a series of mmap calls that require new allocations, a different vulnerability than CVE-2007-6761. NOTE: as of 2016-06-18, this affects only 11 drivers that have not been updated to use videobuf2 instead of videobuf.
ModerateCVE-2010-5321SUSE bug 1035720SUSE bug 916831cpe:/o:suse:suse-microos:5.0CVE-2010-5331SUSE Linux Enterprise Micro 5.0
** DISPUTED ** In the Linux kernel before 2.6.34, a range check issue in drivers/gpu/drm/radeon/atombios.c could cause an off by one (buffer overflow) problem. NOTE: At least one Linux maintainer believes that this CVE is incorrectly assigned and should be rejected because the value is hard coded and are not user-controllable where it is used.
CriticalCVE-2010-5331SUSE bug 1143173cpe:/o:suse:suse-microos:5.0CVE-2010-5332SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 2.6.37, an out of bounds array access happened in drivers/net/mlx4/port.c. When searching for a free entry in either mlx4_register_vlan() or mlx4_register_mac(), and there is no free entry, the loop terminates without updating the local variable free thus causing out of array bounds access.
CriticalCVE-2010-5332SUSE bug 1143170cpe:/o:suse:suse-microos:5.0CVE-2011-0010SUSE Linux Enterprise Micro 5.0
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.
ModerateCVE-2011-0010SUSE bug 663881cpe:/o:suse:suse-microos:5.0CVE-2011-0463SUSE Linux Enterprise Micro 5.0
The ocfs2_prepare_page_for_write function in fs/ocfs2/aops.c in the Oracle Cluster File System 2 (OCFS2) subsystem in the Linux kernel before 2.6.39-rc1 does not properly handle holes that cross page boundaries, which allows local users to obtain potentially sensitive information from uninitialized disk locations by reading a file.
ModerateCVE-2011-0463SUSE bug 670595SUSE bug 673037cpe:/o:suse:suse-microos:5.0CVE-2011-0521SUSE Linux Enterprise Micro 5.0
The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2 does not check the sign of a certain integer field, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a negative value.
ImportantCVE-2011-0521SUSE bug 666836cpe:/o:suse:suse-microos:5.0CVE-2011-0541SUSE Linux Enterprise Micro 5.0
fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack.
LowCVE-2011-0541SUSE bug 668820SUSE bug 685055cpe:/o:suse:suse-microos:5.0CVE-2011-0699SUSE Linux Enterprise Micro 5.0
Integer signedness error in the btrfs_ioctl_space_info function in the Linux kernel 2.6.37 allows local users to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted slot value.
ModerateCVE-2011-0699SUSE bug 1167455cpe:/o:suse:suse-microos:5.0CVE-2011-0709SUSE Linux Enterprise Micro 5.0
The br_mdb_ip_get function in net/bridge/br_multicast.c in the Linux kernel before 2.6.35-rc5 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an IGMP packet, related to lack of a multicast table.
ImportantCVE-2011-0709SUSE bug 672493cpe:/o:suse:suse-microos:5.0CVE-2011-0710SUSE Linux Enterprise Micro 5.0
The task_show_regs function in arch/s390/kernel/traps.c in the Linux kernel before 2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of an arbitrary process by reading a status file under /proc/.
ModerateCVE-2011-0710SUSE bug 672492cpe:/o:suse:suse-microos:5.0CVE-2011-0711SUSE Linux Enterprise Micro 5.0
The xfs_fs_geometry function in fs/xfs/xfs_fsops.c in the Linux kernel before 2.6.38-rc6-git3 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FSGEOMETRY_V1 ioctl call.
ModerateCVE-2011-0711SUSE bug 672505SUSE bug 672524cpe:/o:suse:suse-microos:5.0CVE-2011-0712SUSE Linux Enterprise Micro 5.0
Multiple buffer overflows in the caiaq Native Instruments USB audio functionality in the Linux kernel before 2.6.38-rc4-next-20110215 might allow attackers to cause a denial of service or possibly have unspecified other impact via a long USB device name, related to (1) the snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and (2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c.
ImportantCVE-2011-0712SUSE bug 672499cpe:/o:suse:suse-microos:5.0CVE-2011-0726SUSE Linux Enterprise Micro 5.0
The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE binary.
LowCVE-2011-0726SUSE bug 701254cpe:/o:suse:suse-microos:5.0CVE-2011-0999SUSE Linux Enterprise Micro 5.0
mm/huge_memory.c in the Linux kernel before 2.6.38-rc5 does not prevent creation of a transparent huge page (THP) during the existence of a temporary stack for an exec system call, which allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact via a crafted application.
ModerateCVE-2011-0999SUSE bug 1183531SUSE bug 673261cpe:/o:suse:suse-microos:5.0CVE-2011-1010SUSE Linux Enterprise Micro 5.0
Buffer overflow in the mac_partition function in fs/partitions/mac.c in the Linux kernel before 2.6.37.2 allows local users to cause a denial of service (panic) or possibly have unspecified other impact via a malformed Mac OS partition table.
ModerateCVE-2011-1010SUSE bug 673929SUSE bug 690537cpe:/o:suse:suse-microos:5.0CVE-2011-1012SUSE Linux Enterprise Micro 5.0
The ldm_parse_vmdb function in fs/partitions/ldm.c in the Linux kernel before 2.6.38-rc6-git6 does not validate the VBLK size value in the VMDB structure in an LDM partition table, which allows local users to cause a denial of service (divide-by-zero error and OOPS) via a crafted partition table.
ModerateCVE-2011-1012SUSE bug 674254cpe:/o:suse:suse-microos:5.0CVE-2011-1013SUSE Linux Enterprise Micro 5.0
Integer signedness error in the drm_modeset_ctl function in (1) drivers/gpu/drm/drm_irq.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.38 and (2) sys/dev/pci/drm/drm_irq.c in the kernel in OpenBSD before 4.9 allows local users to trigger out-of-bounds write operations, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via a crafted num_crtcs (aka vb_num) structure member in an ioctl argument.
ImportantCVE-2011-1013SUSE bug 674691cpe:/o:suse:suse-microos:5.0CVE-2011-1016SUSE Linux Enterprise Micro 5.0
The Radeon GPU drivers in the Linux kernel before 2.6.38-rc5 do not properly validate data related to the AA resolve registers, which allows local users to write to arbitrary memory locations associated with (1) Video RAM (aka VRAM) or (2) the Graphics Translation Table (GTT) via crafted values.
ModerateCVE-2011-1016SUSE bug 674691SUSE bug 674693cpe:/o:suse:suse-microos:5.0CVE-2011-1017SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel 2.6.37.2 and earlier might allow local users to gain privileges or obtain sensitive information via a crafted LDM partition table.
ImportantCVE-2011-1017SUSE bug 674648SUSE bug 698221cpe:/o:suse:suse-microos:5.0CVE-2011-1019SUSE Linux Enterprise Micro 5.0
The dev_load function in net/core/dev.c in the Linux kernel before 2.6.38 allows local users to bypass an intended CAP_SYS_MODULE capability requirement and load arbitrary modules by leveraging the CAP_NET_ADMIN capability.
ModerateCVE-2011-1019SUSE bug 674978cpe:/o:suse:suse-microos:5.0CVE-2011-1020SUSE Linux Enterprise Micro 5.0
The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write system calls.
ModerateCVE-2011-1020SUSE bug 674982cpe:/o:suse:suse-microos:5.0CVE-2011-1021SUSE Linux Enterprise Micro 5.0
drivers/acpi/debugfs.c in the Linux kernel before 3.0 allows local users to modify arbitrary kernel memory locations by leveraging root privileges to write to the /sys/kernel/debug/acpi/custom_method file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4347.
ModerateCVE-2011-1021SUSE bug 674988cpe:/o:suse:suse-microos:5.0CVE-2011-1023SUSE Linux Enterprise Micro 5.0
The Reliable Datagram Sockets (RDS) subsystem in the Linux kernel before 2.6.38 does not properly handle congestion map updates, which allows local users to cause a denial of service (BUG_ON and system crash) via vectors involving (1) a loopback (aka loop) transmit operation or (2) an InfiniBand (aka ib) transmit operation.
ModerateCVE-2011-1023SUSE bug 676707SUSE bug 703752cpe:/o:suse:suse-microos:5.0CVE-2011-1076SUSE Linux Enterprise Micro 5.0
net/dns_resolver/dns_key.c in the Linux kernel before 2.6.38 allows remote DNS servers to cause a denial of service (NULL pointer dereference and OOPS) by not providing a valid response to a DNS query, as demonstrated by an erroneous grand.centrall.org query, which triggers improper handling of error data within a DNS resolver key.
ModerateCVE-2011-1076SUSE bug 702355cpe:/o:suse:suse-microos:5.0CVE-2011-1078SUSE Linux Enterprise Micro 5.0
The sco_sock_getsockopt_old function in net/bluetooth/sco.c in the Linux kernel before 2.6.39 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via the SCO_CONNINFO option.
LowCVE-2011-1078SUSE bug 676601cpe:/o:suse:suse-microos:5.0CVE-2011-1079SUSE Linux Enterprise Micro 5.0
The bnep_sock_ioctl function in net/bluetooth/bnep/sock.c in the Linux kernel before 2.6.39 does not ensure that a certain device field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory, or cause a denial of service (BUG and system crash), via a BNEPCONNADD command.
ModerateCVE-2011-1079SUSE bug 1139868SUSE bug 676601cpe:/o:suse:suse-microos:5.0CVE-2011-1080SUSE Linux Enterprise Micro 5.0
The do_replace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability to replace a table, and then reading a modprobe command line.
LowCVE-2011-1080SUSE bug 676602cpe:/o:suse:suse-microos:5.0CVE-2011-1082SUSE Linux Enterprise Micro 5.0
fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.
ModerateCVE-2011-1082SUSE bug 676202SUSE bug 690537cpe:/o:suse:suse-microos:5.0CVE-2011-1083SUSE Linux Enterprise Micro 5.0
The epoll implementation in the Linux kernel 2.6.37.2 and earlier does not properly traverse a tree of epoll file descriptors, which allows local users to cause a denial of service (CPU consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.
ModerateCVE-2011-1083SUSE bug 676204SUSE bug 690537cpe:/o:suse:suse-microos:5.0CVE-2011-1090SUSE Linux Enterprise Micro 5.0
The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a denial of service (panic) via a crafted attempt to set an ACL.
ModerateCVE-2011-1090SUSE bug 677286cpe:/o:suse:suse-microos:5.0CVE-2011-1093SUSE Linux Enterprise Micro 5.0
The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint, which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet.
ImportantCVE-2011-1093SUSE bug 677676cpe:/o:suse:suse-microos:5.0CVE-2011-1098SUSE Linux Enterprise Micro 5.0
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
LowCVE-2011-1098SUSE bug 1007000SUSE bug 1136195SUSE bug 677335SUSE bug 677336cpe:/o:suse:suse-microos:5.0CVE-2011-1154SUSE Linux Enterprise Micro 5.0
The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
ModerateCVE-2011-1154SUSE bug 677335SUSE bug 679661SUSE bug 681984cpe:/o:suse:suse-microos:5.0CVE-2011-1155SUSE Linux Enterprise Micro 5.0
The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
LowCVE-2011-1155SUSE bug 677335SUSE bug 679662cpe:/o:suse:suse-microos:5.0CVE-2011-1160SUSE Linux Enterprise Micro 5.0
The tpm_open function in drivers/char/tpm/tpm.c in the Linux kernel before 2.6.39 does not initialize a certain buffer, which allows local users to obtain potentially sensitive information from kernel memory via unspecified vectors.
LowCVE-2011-1160SUSE bug 680040cpe:/o:suse:suse-microos:5.0CVE-2011-1162SUSE Linux Enterprise Micro 5.0
The tpm_read function in the Linux kernel 2.6 does not properly clear memory, which might allow local users to read the results of the previous TPM command.
LowCVE-2011-1162SUSE bug 680040cpe:/o:suse:suse-microos:5.0CVE-2011-1163SUSE Linux Enterprise Micro 5.0
The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing.
LowCVE-2011-1163SUSE bug 679812cpe:/o:suse:suse-microos:5.0CVE-2011-1169SUSE Linux Enterprise Micro 5.0
Array index error in the asihpi_hpi_ioctl function in sound/pci/asihpi/hpioctl.c in the AudioScience HPI driver in the Linux kernel before 2.6.38.1 might allow local users to cause a denial of service (memory corruption) or possibly gain privileges via a crafted adapter index value that triggers access to an invalid kernel pointer.
ImportantCVE-2011-1169SUSE bug 680816cpe:/o:suse:suse-microos:5.0CVE-2011-1170SUSE Linux Enterprise Micro 5.0
net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
LowCVE-2011-1170SUSE bug 681180cpe:/o:suse:suse-microos:5.0CVE-2011-1171SUSE Linux Enterprise Micro 5.0
net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
LowCVE-2011-1171SUSE bug 681181cpe:/o:suse:suse-microos:5.0CVE-2011-1172SUSE Linux Enterprise Micro 5.0
net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
LowCVE-2011-1172SUSE bug 681185SUSE bug 693976cpe:/o:suse:suse-microos:5.0CVE-2011-1173SUSE Linux Enterprise Micro 5.0
The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.39 on the x86_64 platform allows remote attackers to obtain potentially sensitive information from kernel stack memory by reading uninitialized data in the ah field of an Acorn Universal Networking (AUN) packet.
ModerateCVE-2011-1173SUSE bug 681186cpe:/o:suse:suse-microos:5.0CVE-2011-1182SUSE Linux Enterprise Micro 5.0
kernel/signal.c in the Linux kernel before 2.6.39 allows local users to spoof the uid and pid of a signal sender via a sigqueueinfo system call.
ModerateCVE-2011-1182SUSE bug 681826SUSE bug 690537cpe:/o:suse:suse-microos:5.0CVE-2011-1410SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ImportantCVE-2011-1410SUSE bug 706386cpe:/o:suse:suse-microos:5.0CVE-2011-1478SUSE Linux Enterprise Micro 5.0
The napi_reuse_skb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service (NULL pointer dereference) via a malformed VLAN frame.
ModerateCVE-2011-1478SUSE bug 682965SUSE bug 698450cpe:/o:suse:suse-microos:5.0CVE-2011-1479SUSE Linux Enterprise Micro 5.0
Double free vulnerability in the inotify subsystem in the Linux kernel before 2.6.39 allows local users to cause a denial of service (system crash) via vectors involving failed attempts to create files. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-4250.
ModerateCVE-2011-1479SUSE bug 655693cpe:/o:suse:suse-microos:5.0CVE-2011-1493SUSE Linux Enterprise Micro 5.0
Array index error in the rose_parse_national function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by composing FAC_NATIONAL_DIGIS data that specifies a large number of digipeaters, and then sending this data to a ROSE socket.
ImportantCVE-2011-1493SUSE bug 681175cpe:/o:suse:suse-microos:5.0CVE-2011-1494SUSE Linux Enterprise Micro 5.0
Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
ModerateCVE-2011-1494SUSE bug 685402cpe:/o:suse:suse-microos:5.0CVE-2011-1495SUSE Linux Enterprise Micro 5.0
drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
ImportantCVE-2011-1495SUSE bug 685402cpe:/o:suse:suse-microos:5.0CVE-2011-1573SUSE Linux Enterprise Micro 5.0
net/sctp/sm_make_chunk.c in the Linux kernel before 2.6.34, when addip_enable and auth_enable are used, does not consider the amount of zero padding during calculation of chunk lengths for (1) INIT and (2) INIT ACK chunks, which allows remote attackers to cause a denial of service (OOPS) via crafted packet data.
ModerateCVE-2011-1573SUSE bug 686813cpe:/o:suse:suse-microos:5.0CVE-2011-1576SUSE Linux Enterprise Micro 5.0
The Generic Receive Offload (GRO) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization (RHEV) Hypervisor and other products, allows remote attackers to cause a denial of service via crafted VLAN packets that are processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a different vulnerability than CVE-2011-1478.
ModerateCVE-2011-1576SUSE bug 698450cpe:/o:suse:suse-microos:5.0CVE-2011-1577SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38 and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
ModerateCVE-2011-1577SUSE bug 687113SUSE bug 692784cpe:/o:suse:suse-microos:5.0CVE-2011-1585SUSE Linux Enterprise Micro 5.0
The cifs_find_smb_ses function in fs/cifs/connect.c in the Linux kernel before 2.6.36 does not properly determine the associations between users and sessions, which allows local users to bypass CIFS share authentication by leveraging a mount of a share by a different user.
LowCVE-2011-1585SUSE bug 687812cpe:/o:suse:suse-microos:5.0CVE-2011-1598SUSE Linux Enterprise Micro 5.0
The bcm_release function in net/can/bcm.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.
ModerateCVE-2011-1598SUSE bug 688685SUSE bug 689038cpe:/o:suse:suse-microos:5.0CVE-2011-1745SUSE Linux Enterprise Micro 5.0
Integer overflow in the agp_generic_insert_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_BIND agp_ioctl ioctl call.
ModerateCVE-2011-1745SUSE bug 689797SUSE bug 693043cpe:/o:suse:suse-microos:5.0CVE-2011-1747SUSE Linux Enterprise Micro 5.0
The agp subsystem in the Linux kernel 2.6.38.5 and earlier does not properly restrict memory allocation by the (1) AGPIOC_RESERVE and (2) AGPIOC_ALLOCATE ioctls, which allows local users to cause a denial of service (memory consumption) by making many calls to these ioctls.
ModerateCVE-2011-1747SUSE bug 689797cpe:/o:suse:suse-microos:5.0CVE-2011-1767SUSE Linux Enterprise Micro 5.0
net/ipv4/ip_gre.c in the Linux kernel before 2.6.34, when ip_gre is configured as a module, allows remote attackers to cause a denial of service (OOPS) by sending a packet during module loading.
ModerateCVE-2011-1767SUSE bug 692239cpe:/o:suse:suse-microos:5.0CVE-2011-1770SUSE Linux Enterprise Micro 5.0
Integer underflow in the dccp_parse_options function (net/dccp/options.c) in the Linux kernel before 2.6.33.14 allows remote attackers to cause a denial of service via a Datagram Congestion Control Protocol (DCCP) packet with an invalid feature options length, which triggers a buffer over-read.
ImportantCVE-2011-1770SUSE bug 692498cpe:/o:suse:suse-microos:5.0CVE-2011-1771SUSE Linux Enterprise Micro 5.0
The cifs_close function in fs/cifs/file.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact by setting the O_DIRECT flag during an attempt to open a file on a CIFS filesystem.
ImportantCVE-2011-1771SUSE bug 692497cpe:/o:suse:suse-microos:5.0CVE-2011-1776SUSE Linux Enterprise Micro 5.0
The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allows physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577.
ModerateCVE-2011-1776SUSE bug 692784cpe:/o:suse:suse-microos:5.0CVE-2011-1833SUSE Linux Enterprise Micro 5.0
Race condition in the ecryptfs_mount function in fs/ecryptfs/main.c in the eCryptfs subsystem in the Linux kernel before 3.1 allows local users to bypass intended file permissions via a mount.ecryptfs_private mount with a mismatched uid.
ModerateCVE-2011-1833SUSE bug 709771SUSE bug 711539cpe:/o:suse:suse-microos:5.0CVE-2011-1927SUSE Linux Enterprise Micro 5.0
The ip_expire function in net/ipv4/ip_fragment.c in the Linux kernel before 2.6.39 does not properly construct ICMP_TIME_EXCEEDED packets after a timeout, which allows remote attackers to cause a denial of service (invalid pointer dereference) via crafted fragmented packets.
ImportantCVE-2011-1927SUSE bug 694498cpe:/o:suse:suse-microos:5.0CVE-2011-2182SUSE Linux Enterprise Micro 5.0
The ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel before 2.6.39.1 does not properly handle memory allocation for non-initial fragments, which might allow local users to conduct buffer overflow attacks, and gain privileges or obtain sensitive information, via a crafted LDM partition table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1017.
ImportantCVE-2011-2182SUSE bug 674648SUSE bug 698221cpe:/o:suse:suse-microos:5.0CVE-2011-2189SUSE Linux Enterprise Micro 5.0
net/core/net_namespace.c in the Linux kernel 2.6.32 and earlier does not properly handle a high rate of creation and cleanup of network namespaces, which makes it easier for remote attackers to cause a denial of service (memory consumption) via requests to a daemon that requires a separate namespace per connection, as demonstrated by vsftpd.
ImportantCVE-2011-2189SUSE bug 698449cpe:/o:suse:suse-microos:5.0CVE-2011-2203SUSE Linux Enterprise Micro 5.0
The hfs_find_init function in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and Oops) by mounting an HFS file system with a malformed MDB extent record.
LowCVE-2011-2203SUSE bug 699709cpe:/o:suse:suse-microos:5.0CVE-2011-2213SUSE Linux Enterprise Micro 5.0
The inet_diag_bc_audit function in net/ipv4/inet_diag.c in the Linux kernel before 2.6.39.3 does not properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message, as demonstrated by an INET_DIAG_BC_JMP instruction with a zero yes value, a different vulnerability than CVE-2010-3880.
ModerateCVE-2011-2213SUSE bug 700879cpe:/o:suse:suse-microos:5.0CVE-2011-2482SUSE Linux Enterprise Micro 5.0
A certain Red Hat patch to the sctp_sock_migrate function in net/sctp/socket.c in the Linux kernel before 2.6.21, as used in Red Hat Enterprise Linux (RHEL) 5, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted SCTP packet.
ImportantCVE-2011-2482SUSE bug 735611SUSE bug 750395cpe:/o:suse:suse-microos:5.0CVE-2011-2484SUSE Linux Enterprise Micro 5.0
The add_del_listener function in kernel/taskstats.c in the Linux kernel 2.6.39.1 and earlier does not prevent multiple registrations of exit handlers, which allows local users to cause a denial of service (memory and CPU consumption), and bypass the OOM Killer, via a crafted application.
ModerateCVE-2011-2484SUSE bug 703153cpe:/o:suse:suse-microos:5.0CVE-2011-2491SUSE Linux Enterprise Micro 5.0
The Network Lock Manager (NLM) protocol implementation in the NFS client functionality in the Linux kernel before 3.0 allows local users to cause a denial of service (system hang) via a LOCK_UN flock system call.
ModerateCVE-2011-2491SUSE bug 702013cpe:/o:suse:suse-microos:5.0CVE-2011-2492SUSE Linux Enterprise Micro 5.0
The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c.
ModerateCVE-2011-2492SUSE bug 702014cpe:/o:suse:suse-microos:5.0CVE-2011-2493SUSE Linux Enterprise Micro 5.0
The ext4_fill_super function in fs/ext4/super.c in the Linux kernel before 2.6.39 does not properly initialize a certain error-report data structure, which allows local users to cause a denial of service (OOPS) by attempting to mount a crafted ext4 filesystem.
LowCVE-2011-2493SUSE bug 701998cpe:/o:suse:suse-microos:5.0CVE-2011-2494SUSE Linux Enterprise Micro 5.0
kernel/taskstats.c in the Linux kernel before 3.1 allows local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another user's password.
LowCVE-2011-2494SUSE bug 703156cpe:/o:suse:suse-microos:5.0CVE-2011-2497SUSE Linux Enterprise Micro 5.0
Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a small command-size value within the command header of a Logical Link Control and Adaptation Protocol (L2CAP) configuration request, leading to a buffer overflow.
ImportantCVE-2011-2497SUSE bug 702286cpe:/o:suse:suse-microos:5.0CVE-2011-2517SUSE Linux Enterprise Micro 5.0
Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value.
ImportantCVE-2011-2517SUSE bug 703410cpe:/o:suse:suse-microos:5.0CVE-2011-2518SUSE Linux Enterprise Micro 5.0
The tomoyo_mount_acl function in security/tomoyo/mount.c in the Linux kernel before 2.6.39.2 calls the kern_path function with arguments taken directly from a mount system call, which allows local users to cause a denial of service (OOPS) or possibly have unspecified other impact via a NULL value for the device name.
ModerateCVE-2011-2518SUSE bug 703158cpe:/o:suse:suse-microos:5.0CVE-2011-2525SUSE Linux Enterprise Micro 5.0
The qdisc_notify function in net/sched/sch_api.c in the Linux kernel before 2.6.35 does not prevent tc_fill_qdisc function calls referencing builtin (aka CQ_F_BUILTIN) Qdisc structures, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted call.
ImportantCVE-2011-2525SUSE bug 735612cpe:/o:suse:suse-microos:5.0CVE-2011-2534SUSE Linux Enterprise Micro 5.0
Buffer overflow in the clusterip_proc_write function in net/ipv4/netfilter/ipt_CLUSTERIP.c in the Linux kernel before 2.6.39 might allow local users to cause a denial of service or have unspecified other impact via a crafted write operation, related to string data that lacks a terminating '\0' character.
ModerateCVE-2011-2534SUSE bug 681182SUSE bug 702037cpe:/o:suse:suse-microos:5.0CVE-2011-2689SUSE Linux Enterprise Micro 5.0
The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of service (BUG and system crash) by arranging for all resource groups to have too little free space.
ModerateCVE-2011-2689SUSE bug 710672cpe:/o:suse:suse-microos:5.0CVE-2011-2695SUSE Linux Enterprise Micro 5.0
Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.
ModerateCVE-2011-2695SUSE bug 706374cpe:/o:suse:suse-microos:5.0CVE-2011-2699SUSE Linux Enterprise Micro 5.0
The IPv6 implementation in the Linux kernel before 3.1 does not generate Fragment Identification values separately for each destination, which makes it easier for remote attackers to cause a denial of service (disrupted networking) by predicting these values and sending crafted packets.
ImportantCVE-2011-2699SUSE bug 707288cpe:/o:suse:suse-microos:5.0CVE-2011-2700SUSE Linux Enterprise Micro 5.0
Multiple buffer overflows in the si4713_write_econtrol_string function in drivers/media/radio/si4713-i2c.c in the Linux kernel before 2.6.39.4 on the N900 platform might allow local users to cause a denial of service or have unspecified other impact via a crafted s_ext_ctrls operation with a (1) V4L2_CID_RDS_TX_PS_NAME or (2) V4L2_CID_RDS_TX_RADIO_TEXT control ID.
ModerateCVE-2011-2700SUSE bug 707332cpe:/o:suse:suse-microos:5.0CVE-2011-2707SUSE Linux Enterprise Micro 5.0
The ptrace_setxregs function in arch/xtensa/kernel/ptrace.c in the Linux kernel before 3.1 does not validate user-space pointers, which allows local users to obtain sensitive information from kernel memory locations via a crafted PTRACE_SETXTREGS request.
ModerateCVE-2011-2707SUSE bug 707337cpe:/o:suse:suse-microos:5.0CVE-2011-2898SUSE Linux Enterprise Micro 5.0
net/packet/af_packet.c in the Linux kernel before 2.6.39.3 does not properly restrict user-space access to certain packet data structures associated with VLAN Tag Control Information, which allows local users to obtain potentially sensitive information via a crafted application.
ModerateCVE-2011-2898SUSE bug 710235cpe:/o:suse:suse-microos:5.0CVE-2011-2905SUSE Linux Enterprise Micro 5.0
Untrusted search path vulnerability in the perf_config function in tools/perf/util/config.c in perf, as distributed in the Linux kernel before 3.1, allows local users to overwrite arbitrary files via a crafted config file in the current working directory.
ModerateCVE-2011-2905SUSE bug 711414cpe:/o:suse:suse-microos:5.0CVE-2011-2918SUSE Linux Enterprise Micro 5.0
The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_CLOCK events, which allows local users to cause a denial of service (system hang) via a crafted application.
ModerateCVE-2011-2918SUSE bug 712366SUSE bug 713650cpe:/o:suse:suse-microos:5.0CVE-2011-2928SUSE Linux Enterprise Micro 5.0
The befs_follow_link function in fs/befs/linuxvfs.c in the Linux kernel before 3.1-rc3 does not validate the length attribute of long symlinks, which allows local users to cause a denial of service (incorrect pointer dereference and OOPS) by accessing a long symlink on a malformed Be filesystem.
ModerateCVE-2011-2928SUSE bug 713430cpe:/o:suse:suse-microos:5.0CVE-2011-2942SUSE Linux Enterprise Micro 5.0
A certain Red Hat patch to the __br_deliver function in net/bridge/br_forward.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging connectivity to a network interface that uses an Ethernet bridge device.
ModerateCVE-2011-2942SUSE bug 726064cpe:/o:suse:suse-microos:5.0CVE-2011-3188SUSE Linux Enterprise Micro 5.0
The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets.
CriticalCVE-2011-3188SUSE bug 713650SUSE bug 737874cpe:/o:suse:suse-microos:5.0CVE-2011-3191SUSE Linux Enterprise Micro 5.0
Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c in the Linux kernel before 3.1 allows remote CIFS servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large length value in a response to a read request for a directory.
ImportantCVE-2011-3191SUSE bug 714001cpe:/o:suse:suse-microos:5.0CVE-2011-3359SUSE Linux Enterprise Micro 5.0
The dma_rx function in drivers/net/wireless/b43/dma.c in the Linux kernel before 2.6.39 does not properly allocate receive buffers, which allows remote attackers to cause a denial of service (system crash) via a crafted frame.
ImportantCVE-2011-3359SUSE bug 717749cpe:/o:suse:suse-microos:5.0CVE-2011-3363SUSE Linux Enterprise Micro 5.0
The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a share.
ModerateCVE-2011-3363SUSE bug 718028cpe:/o:suse:suse-microos:5.0CVE-2011-3593SUSE Linux Enterprise Micro 5.0
A certain Red Hat patch to the vlan_hwaccel_do_receive function in net/8021q/vlan_core.c in the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 allows remote attackers to cause a denial of service (system crash) via priority-tagged VLAN frames.
ModerateCVE-2011-3593SUSE bug 735347cpe:/o:suse:suse-microos:5.0CVE-2011-3630SUSE Linux Enterprise Micro 5.0
Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directories are processed. A remote attacker could provide a specially-crafted directory tree, and trick the local user into consolidating it, leading to hardlink executable crash, or, potentially arbitrary code execution with the privileges of the user running the hardlink executable.
ModerateCVE-2011-3630cpe:/o:suse:suse-microos:5.0CVE-2011-3631SUSE Linux Enterprise Micro 5.0
Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation is done in the calculation of the required memory space to be used. A remote attacker could provide a specially-crafted directory tree and trick the local user into consolidating it, leading to hardlink executable crash or potentially arbitrary code execution with user privileges.
ModerateCVE-2011-3631cpe:/o:suse:suse-microos:5.0CVE-2011-3632SUSE Linux Enterprise Micro 5.0
Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink attacks.
LowCVE-2011-3632cpe:/o:suse:suse-microos:5.0CVE-2011-3638SUSE Linux Enterprise Micro 5.0
fs/ext4/extents.c in the Linux kernel before 3.0 does not mark a modified extent as dirty in certain cases of extent splitting, which allows local users to cause a denial of service (system crash) via vectors involving ext4 umount and mount operations.
LowCVE-2011-3638SUSE bug 726045cpe:/o:suse:suse-microos:5.0CVE-2011-4077SUSE Linux Enterprise Micro 5.0
Buffer overflow in the xfs_readlink function in fs/xfs/xfs_vnodeops.c in XFS in the Linux kernel 2.6, when CONFIG_XFS_DEBUG is disabled, allows local users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via an XFS image containing a symbolic link with a long pathname.
ModerateCVE-2011-4077SUSE bug 726600cpe:/o:suse:suse-microos:5.0CVE-2011-4080SUSE Linux Enterprise Micro 5.0
The sysrq_sysctl_handler function in kernel/sysctl.c in the Linux kernel before 2.6.39 does not require the CAP_SYS_ADMIN capability to modify the dmesg_restrict value, which allows local users to bypass intended access restrictions and read the kernel ring buffer by leveraging root privileges, as demonstrated by a root user in a Linux Containers (aka LXC) environment.
LowCVE-2011-4080SUSE bug 726772cpe:/o:suse:suse-microos:5.0CVE-2011-4081SUSE Linux Enterprise Micro 5.0
crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by triggering a failed or missing ghash_setkey function call, followed by a (1) ghash_update function call or (2) ghash_final function call, as demonstrated by a write operation on an AF_ALG socket.
ModerateCVE-2011-4081SUSE bug 726788cpe:/o:suse:suse-microos:5.0CVE-2011-4086SUSE Linux Enterprise Micro 5.0
The journal_unmap_buffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the _Delay and _Unwritten buffer head states, which allows local users to cause a denial of service (system crash) by leveraging the presence of an ext4 filesystem that was mounted with a journal.
ModerateCVE-2011-4086SUSE bug 745832cpe:/o:suse:suse-microos:5.0CVE-2011-4110SUSE Linux Enterprise Micro 5.0
The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and "updating a negative key into a fully instantiated key."
ModerateCVE-2011-4110SUSE bug 734056cpe:/o:suse:suse-microos:5.0CVE-2011-4131SUSE Linux Enterprise Micro 5.0
The NFSv4 implementation in the Linux kernel before 3.2.2 does not properly handle bitmap sizes in GETACL replies, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words.
ModerateCVE-2011-4131SUSE bug 730117SUSE bug 762992cpe:/o:suse:suse-microos:5.0CVE-2011-4132SUSE Linux Enterprise Micro 5.0
The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allows local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an "invalid log first block value."
LowCVE-2011-4132SUSE bug 730118cpe:/o:suse:suse-microos:5.0CVE-2011-4324SUSE Linux Enterprise Micro 5.0
The encode_share_access function in fs/nfs/nfs4xdr.c in the Linux kernel before 2.6.29 allows local users to cause a denial of service (BUG and system crash) by using the mknod system call with a pathname on an NFSv4 filesystem.
ModerateCVE-2011-4324SUSE bug 732613cpe:/o:suse:suse-microos:5.0CVE-2011-4326SUSE Linux Enterprise Micro 5.0
The udp6_ufo_fragment function in net/ipv6/udp.c in the Linux kernel before 2.6.39, when a certain UDP Fragmentation Offload (UFO) configuration is enabled, allows remote attackers to cause a denial of service (system crash) by sending fragmented IPv6 UDP packets to a bridge device.
ImportantCVE-2011-4326SUSE bug 732021cpe:/o:suse:suse-microos:5.0CVE-2011-4330SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the hfs_mac2asc function in fs/hfs/trans.c in the Linux kernel 2.6 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via an HFS image with a crafted len field.
ImportantCVE-2011-4330SUSE bug 731673SUSE bug 941447cpe:/o:suse:suse-microos:5.0CVE-2011-4348SUSE Linux Enterprise Micro 5.0
Race condition in the sctp_rcv function in net/sctp/input.c in the Linux kernel before 2.6.29 allows remote attackers to cause a denial of service (system hang) via SCTP packets. NOTE: in some environments, this issue exists because of an incomplete fix for CVE-2011-2482.
ImportantCVE-2011-4348SUSE bug 750395cpe:/o:suse:suse-microos:5.0CVE-2011-4594SUSE Linux Enterprise Micro 5.0
The __sys_sendmsg function in net/socket.c in the Linux kernel before 3.1 allows local users to cause a denial of service (system crash) via crafted use of the sendmmsg system call, leading to an incorrect pointer dereference.
ModerateCVE-2011-4594SUSE bug 735810cpe:/o:suse:suse-microos:5.0CVE-2011-4604SUSE Linux Enterprise Micro 5.0
The bat_socket_read function in net/batman-adv/icmp_socket.c in the Linux kernel before 3.3 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted batman-adv ICMP packet.
ModerateCVE-2011-4604SUSE bug 736149cpe:/o:suse:suse-microos:5.0CVE-2011-4611SUSE Linux Enterprise Micro 5.0
Integer overflow in the perf_event_interrupt function in arch/powerpc/kernel/perf_event.c in the Linux kernel before 2.6.39 on powerpc platforms allows local users to cause a denial of service (unhandled performance monitor exception) via vectors that trigger certain outcomes of performance events.
ModerateCVE-2011-4611SUSE bug 744023cpe:/o:suse:suse-microos:5.0CVE-2011-4915SUSE Linux Enterprise Micro 5.0
fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /proc/interrupts.
LowCVE-2011-4915SUSE bug 738749cpe:/o:suse:suse-microos:5.0CVE-2011-5321SUSE Linux Enterprise Micro 5.0
The tty_open function in drivers/tty/tty_io.c in the Linux kernel before 3.1.1 mishandles a driver-lookup failure, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted access to a device file under the /dev/pts directory.
ModerateCVE-2011-5321SUSE bug 922447cpe:/o:suse:suse-microos:5.0CVE-2011-5327SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 3.1, an off by one in the drivers/target/loopback/tcm_loop.c tcm_loop_make_naa_tpg() function could result in at least memory corruption.
CriticalCVE-2011-5327SUSE bug 1143175cpe:/o:suse:suse-microos:5.0CVE-2012-0028SUSE Linux Enterprise Micro 5.0
The robust futex implementation in the Linux kernel before 2.6.28 does not properly handle processes that make exec system calls, which allows local users to cause a denial of service or possibly gain privileges by writing to a memory location in a child process.
ImportantCVE-2012-0028SUSE bug 739721cpe:/o:suse:suse-microos:5.0CVE-2012-0045SUSE Linux Enterprise Micro 5.0
The em_syscall function in arch/x86/kvm/emulate.c in the KVM implementation in the Linux kernel before 3.2.14 does not properly handle the 0f05 (aka syscall) opcode, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application, as demonstrated by an NASM file.
ModerateCVE-2012-0045SUSE bug 740969cpe:/o:suse:suse-microos:5.0CVE-2012-0055SUSE Linux Enterprise Micro 5.0
OverlayFS in the Linux kernel before 3.0.0-16.28, as used in Ubuntu 10.0.4 LTS and 11.10, is missing inode security checks which could allow attackers to bypass security restrictions and perform unauthorized actions.
ImportantCVE-2012-0055SUSE bug 742027cpe:/o:suse:suse-microos:5.0CVE-2012-0056SUSE Linux Enterprise Micro 5.0
The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper.
ModerateCVE-2012-0056SUSE bug 1171985SUSE bug 742028SUSE bug 742279cpe:/o:suse:suse-microos:5.0CVE-2012-0058SUSE Linux Enterprise Micro 5.0
The kiocb_batch_free function in fs/aio.c in the Linux kernel before 3.2.2 allows local users to cause a denial of service (OOPS) via vectors that trigger incorrect iocb management.
ModerateCVE-2012-0058SUSE bug 742030cpe:/o:suse:suse-microos:5.0CVE-2012-0444SUSE Linux Enterprise Micro 5.0
Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file.
CriticalCVE-2012-0444SUSE bug 744275SUSE bug 747912cpe:/o:suse:suse-microos:5.0CVE-2012-0786SUSE Linux Enterprise Micro 5.0
The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file.
LowCVE-2012-0786SUSE bug 853044SUSE bug 885003cpe:/o:suse:suse-microos:5.0CVE-2012-0810SUSE Linux Enterprise Micro 5.0
The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stack corruption and panic) via a crafted application that triggers certain lock contention.
ModerateCVE-2012-0810SUSE bug 749118cpe:/o:suse:suse-microos:5.0CVE-2012-0876SUSE Linux Enterprise Micro 5.0
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.
ModerateCVE-2012-0876SUSE bug 750914SUSE bug 751464SUSE bug 751465SUSE bug 983215SUSE bug 983216cpe:/o:suse:suse-microos:5.0CVE-2012-0879SUSE Linux Enterprise Micro 5.0
The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONE_IO feature, which allows local users to cause a denial of service (I/O instability) by starting multiple processes that share an I/O context.
ModerateCVE-2012-0879SUSE bug 748812cpe:/o:suse:suse-microos:5.0CVE-2012-0957SUSE Linux Enterprise Micro 5.0
The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.
ModerateCVE-2012-0957SUSE bug 783515SUSE bug 783606cpe:/o:suse:suse-microos:5.0CVE-2012-1090SUSE Linux Enterprise Micro 5.0
The cifs_lookup function in fs/cifs/dir.c in the Linux kernel before 3.2.10 allows local users to cause a denial of service (OOPS) via attempted access to a special file, as demonstrated by a FIFO.
ModerateCVE-2012-1090SUSE bug 749569cpe:/o:suse:suse-microos:5.0CVE-2012-1583SUSE Linux Enterprise Micro 5.0
Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets.
ModerateCVE-2012-1583SUSE bug 757707cpe:/o:suse:suse-microos:5.0CVE-2012-1601SUSE Linux Enterprise Micro 5.0
The KVM implementation in the Linux kernel before 3.3.6 allows host OS users to cause a denial of service (NULL pointer dereference and host OS crash) by making a KVM_CREATE_IRQCHIP ioctl call after a virtual CPU already exists.
ModerateCVE-2012-1601SUSE bug 754898cpe:/o:suse:suse-microos:5.0CVE-2012-2100SUSE Linux Enterprise Micro 5.0
The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 3.2.2, on the x86 platform and unspecified other platforms, allows user-assisted remote attackers to trigger inconsistent filesystem-groups data and possibly cause a denial of service via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value). NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4307.
ImportantCVE-2012-2100SUSE bug 757278cpe:/o:suse:suse-microos:5.0CVE-2012-2119SUSE Linux Enterprise Micro 5.0
Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a denial of service (crash) via a long descriptor with a long vector length.
ModerateCVE-2012-2119SUSE bug 758243cpe:/o:suse:suse-microos:5.0CVE-2012-2121SUSE Linux Enterprise Micro 5.0
The KVM implementation in the Linux kernel before 3.3.4 does not properly manage the relationships between memory slots and the iommu, which allows guest OS users to cause a denial of service (memory leak and host OS crash) by leveraging administrative access to the guest OS to conduct hotunplug and hotplug operations on devices.
ModerateCVE-2012-2121SUSE bug 758355cpe:/o:suse:suse-microos:5.0CVE-2012-2123SUSE Linux Enterprise Micro 5.0
The cap_bprm_set_creds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities (aka fcaps) for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted application, as demonstrated by an attack that uses a parent process to disable ASLR.
ImportantCVE-2012-2123SUSE bug 758260cpe:/o:suse:suse-microos:5.0CVE-2012-2127SUSE Linux Enterprise Micro 5.0
fs/proc/root.c in the procfs implementation in the Linux kernel before 3.2 does not properly interact with CLONE_NEWPID clone system calls, which allows remote attackers to cause a denial of service (reference leak and memory consumption) by making many connections to a daemon that uses PID namespaces to isolate clients, as demonstrated by vsftpd.
ImportantCVE-2012-2127SUSE bug 757783cpe:/o:suse:suse-microos:5.0CVE-2012-2133SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the Linux kernel before 3.3.6, when huge pages are enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges by interacting with a hugetlbfs filesystem, as demonstrated by a umount operation that triggers improper handling of quota data.
ModerateCVE-2012-2133SUSE bug 758532cpe:/o:suse:suse-microos:5.0CVE-2012-2136SUSE Linux Enterprise Micro 5.0
The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a certain length value, which allows local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device.
ImportantCVE-2012-2136SUSE bug 765320cpe:/o:suse:suse-microos:5.0CVE-2012-2137SUSE Linux Enterprise Micro 5.0
Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setup_routing_entry function before invoking the kvm_set_irq function.
ModerateCVE-2012-2137SUSE bug 767612SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2012-2313SUSE Linux Enterprise Micro 5.0
The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call.
ModerateCVE-2012-2313SUSE bug 758813cpe:/o:suse:suse-microos:5.0CVE-2012-2372SUSE Linux Enterprise Micro 5.0
The rds_ib_xmit function in net/rds/ib_send.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel 3.7.4 and earlier allows local users to cause a denial of service (BUG_ON and kernel panic) by establishing an RDS connection with the source IP address equal to the IPoIB interface's own IP address, as demonstrated by rds-ping.
ModerateCVE-2012-2372SUSE bug 767610SUSE bug 795039cpe:/o:suse:suse-microos:5.0CVE-2012-2375SUSE Linux Enterprise Micro 5.0
The __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4_ACL reply. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131.
ModerateCVE-2012-2375SUSE bug 762992SUSE bug 851103cpe:/o:suse:suse-microos:5.0CVE-2012-2383SUSE Linux Enterprise Micro 5.0
Integer overflow in the i915_gem_execbuffer2 function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.
ModerateCVE-2012-2383SUSE bug 763194cpe:/o:suse:suse-microos:5.0CVE-2012-2384SUSE Linux Enterprise Micro 5.0
Integer overflow in the i915_gem_do_execbuffer function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.
ModerateCVE-2012-2384SUSE bug 763194cpe:/o:suse:suse-microos:5.0CVE-2012-2390SUSE Linux Enterprise Micro 5.0
Memory leak in mm/hugetlb.c in the Linux kernel before 3.4.2 allows local users to cause a denial of service (memory consumption or system crash) via invalid MAP_HUGETLB mmap operations.
ModerateCVE-2012-2390SUSE bug 764150cpe:/o:suse:suse-microos:5.0CVE-2012-2669SUSE Linux Enterprise Micro 5.0
The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message.
LowCVE-2012-2669SUSE bug 761200cpe:/o:suse:suse-microos:5.0CVE-2012-2744SUSE Linux Enterprise Micro 5.0
net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets.
ImportantCVE-2012-2744SUSE bug 770697cpe:/o:suse:suse-microos:5.0CVE-2012-2745SUSE Linux Enterprise Micro 5.0
The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.
ModerateCVE-2012-2745SUSE bug 770695SUSE bug 795039cpe:/o:suse:suse-microos:5.0CVE-2012-3364SUSE Linux Enterprise Micro 5.0
Multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Linux kernel before 3.4.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via incoming frames with crafted length fields.
ModerateCVE-2012-3364SUSE bug 769171cpe:/o:suse:suse-microos:5.0CVE-2012-3375SUSE Linux Enterprise Micro 5.0
The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.
ModerateCVE-2012-3375SUSE bug 769896cpe:/o:suse:suse-microos:5.0CVE-2012-3406SUSE Linux Enterprise Micro 5.0
The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.
ModerateCVE-2012-3406SUSE bug 770891SUSE bug 826666cpe:/o:suse:suse-microos:5.0CVE-2012-3412SUSE Linux Enterprise Micro 5.0
The sfc (aka Solarflare Solarstorm) driver in the Linux kernel before 3.2.30 allows remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value.
ImportantCVE-2012-3412SUSE bug 774523cpe:/o:suse:suse-microos:5.0CVE-2012-3430SUSE Linux Enterprise Micro 5.0
The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.
LowCVE-2012-3430SUSE bug 773383SUSE bug 795039cpe:/o:suse:suse-microos:5.0CVE-2012-3510SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel before 2.6.19 allows local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command.
ModerateCVE-2012-3510SUSE bug 776888cpe:/o:suse:suse-microos:5.0CVE-2012-3520SUSE Linux Enterprise Micro 5.0
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.
LowCVE-2012-3520SUSE bug 776925cpe:/o:suse:suse-microos:5.0CVE-2012-3552SUSE Linux Enterprise Micro 5.0
Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.
ImportantCVE-2012-3552SUSE bug 778460SUSE bug 795039SUSE bug 827565cpe:/o:suse:suse-microos:5.0CVE-2012-4024SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
ModerateCVE-2012-4024SUSE bug 773015cpe:/o:suse:suse-microos:5.0CVE-2012-4025SUSE Linux Enterprise Micro 5.0
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.
ModerateCVE-2012-4025SUSE bug 773015cpe:/o:suse:suse-microos:5.0CVE-2012-4398SUSE Linux Enterprise Micro 5.0
The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application.
ModerateCVE-2012-4398SUSE bug 778463SUSE bug 779488cpe:/o:suse:suse-microos:5.0CVE-2012-4444SUSE Linux Enterprise Micro 5.0
The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.
ModerateCVE-2012-4444SUSE bug 789831cpe:/o:suse:suse-microos:5.0CVE-2012-4461SUSE Linux Enterprise Micro 5.0
The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without XSAVE, allows local users to cause a denial of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to set the X86_CR4_OSXSAVE bit in the guest cr4 register, then calling the KVM_RUN ioctl.
LowCVE-2012-4461SUSE bug 787821cpe:/o:suse:suse-microos:5.0CVE-2012-4508SUSE Linux Enterprise Micro 5.0
Race condition in fs/ext4/extents.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized.
LowCVE-2012-4508SUSE bug 784192cpe:/o:suse:suse-microos:5.0CVE-2012-4530SUSE Linux Enterprise Micro 5.0
The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
LowCVE-2012-4530SUSE bug 786013SUSE bug 841063cpe:/o:suse:suse-microos:5.0CVE-2012-4542SUSE Linux Enterprise Micro 5.0
block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.
ModerateCVE-2012-4542SUSE bug 807154cpe:/o:suse:suse-microos:5.0CVE-2012-4565SUSE Linux Enterprise Micro 5.0
The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) by reading TCP stats.
ModerateCVE-2012-4565SUSE bug 787576cpe:/o:suse:suse-microos:5.0CVE-2012-5517SUSE Linux Enterprise Micro 5.0
The online_pages function in mm/memory_hotplug.c in the Linux kernel before 3.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact in opportunistic circumstances by using memory that was hot-added by an administrator.
ModerateCVE-2012-5517SUSE bug 789235cpe:/o:suse:suse-microos:5.0CVE-2012-5532SUSE Linux Enterprise Micro 5.0
The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause a denial of service (daemon exit) via a crafted application that sends a Netlink message. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2669.
ModerateCVE-2012-5532SUSE bug 791605cpe:/o:suse:suse-microos:5.0CVE-2012-6536SUSE Linux Enterprise Micro 5.0
net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not verify that the actual Netlink message length is consistent with a certain header field, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability and providing a (1) new or (2) updated state.
LowCVE-2012-6536SUSE bug 809889cpe:/o:suse:suse-microos:5.0CVE-2012-6537SUSE Linux Enterprise Micro 5.0
net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.
LowCVE-2012-6537SUSE bug 809889cpe:/o:suse:suse-microos:5.0CVE-2012-6538SUSE Linux Enterprise Micro 5.0
The copy_to_user_auth function in net/xfrm/xfrm_user.c in the Linux kernel before 3.6 uses an incorrect C library function for copying a string, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.
LowCVE-2012-6538SUSE bug 809889cpe:/o:suse:suse-microos:5.0CVE-2012-6539SUSE Linux Enterprise Micro 5.0
The dev_ifconf function in net/socket.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
LowCVE-2012-6539SUSE bug 809891cpe:/o:suse:suse-microos:5.0CVE-2012-6542SUSE Linux Enterprise Micro 5.0
The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel before 3.6 has an incorrect return value in certain circumstances, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that leverages an uninitialized pointer argument.
LowCVE-2012-6542SUSE bug 809894cpe:/o:suse:suse-microos:5.0CVE-2012-6544SUSE Linux Enterprise Micro 5.0
The Bluetooth protocol stack in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that targets the (1) L2CAP or (2) HCI implementation.
LowCVE-2012-6544SUSE bug 809898cpe:/o:suse:suse-microos:5.0CVE-2012-6545SUSE Linux Enterprise Micro 5.0
The Bluetooth RFCOMM implementation in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application.
LowCVE-2012-6545SUSE bug 809899cpe:/o:suse:suse-microos:5.0CVE-2012-6546SUSE Linux Enterprise Micro 5.0
The ATM implementation in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
LowCVE-2012-6546SUSE bug 809900cpe:/o:suse:suse-microos:5.0CVE-2012-6547SUSE Linux Enterprise Micro 5.0
The __tun_chr_ioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
LowCVE-2012-6547SUSE bug 809901cpe:/o:suse:suse-microos:5.0CVE-2012-6548SUSE Linux Enterprise Micro 5.0
The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.
LowCVE-2012-6548SUSE bug 809902SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2012-6549SUSE Linux Enterprise Micro 5.0
The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.
LowCVE-2012-6549SUSE bug 809903SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2012-6647SUSE Linux Enterprise Micro 5.0
The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that calls have two different futex addresses, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted FUTEX_WAIT_REQUEUE_PI command.
ModerateCVE-2012-6647SUSE bug 878289cpe:/o:suse:suse-microos:5.0CVE-2012-6657SUSE Linux Enterprise Micro 5.0
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5.7 does not ensure that a keepalive action is associated with a stream socket, which allows local users to cause a denial of service (system crash) by leveraging the ability to create a raw socket.
ModerateCVE-2012-6657SUSE bug 896779cpe:/o:suse:suse-microos:5.0CVE-2012-6689SUSE Linux Enterprise Micro 5.0
The netlink_sendmsg function in net/netlink/af_netlink.c in the Linux kernel before 3.5.5 does not validate the dst_pid field, which allows local users to have an unspecified impact by spoofing Netlink messages.
ModerateCVE-2012-6689SUSE bug 920170cpe:/o:suse:suse-microos:5.0CVE-2012-6701SUSE Linux Enterprise Micro 5.0
Integer overflow in fs/aio.c in the Linux kernel before 3.4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec.
ModerateCVE-2012-6701SUSE bug 969354SUSE bug 969355cpe:/o:suse:suse-microos:5.0CVE-2012-6702SUSE Linux Enterprise Micro 5.0
Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
ModerateCVE-2012-6702SUSE bug 983215SUSE bug 983216cpe:/o:suse:suse-microos:5.0CVE-2012-6703SUSE Linux Enterprise Micro 5.0
Integer overflow in the snd_compr_allocate_buffer function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.6-rc6-next-20120917 allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.
LowCVE-2012-6703SUSE bug 986811SUSE bug 986941cpe:/o:suse:suse-microos:5.0CVE-2012-6704SUSE Linux Enterprise Micro 5.0
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option.
ModerateCVE-2012-6704SUSE bug 1013531SUSE bug 1013542SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2012-6708SUSE Linux Enterprise Micro 5.0
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.
ModerateCVE-2012-6708SUSE bug 1111661cpe:/o:suse:suse-microos:5.0CVE-2012-6712SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless/iwlwifi/iwl-agn-sta.c, which will cause at least memory corruption.
CriticalCVE-2012-6712SUSE bug 1143176cpe:/o:suse:suse-microos:5.0CVE-2013-0216SUSE Linux Enterprise Micro 5.0
The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption.
ModerateCVE-2013-0216SUSE bug 800280SUSE bug 800801SUSE bug 801178SUSE bug 841063SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-0217SUSE Linux Enterprise Micro 5.0
Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions.
ModerateCVE-2013-0217SUSE bug 800280SUSE bug 800801SUSE bug 801178cpe:/o:suse:suse-microos:5.0CVE-2013-0221SUSE Linux Enterprise Micro 5.0
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the alloca function.
ModerateCVE-2013-0221SUSE bug 798538cpe:/o:suse:suse-microos:5.0CVE-2013-0222SUSE Linux Enterprise Micro 5.0
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.
LowCVE-2013-0222SUSE bug 796243SUSE bug 798538SUSE bug 798541cpe:/o:suse:suse-microos:5.0CVE-2013-0223SUSE Linux Enterprise Micro 5.0
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the join command, when using the -i switch, which triggers a stack-based buffer overflow in the alloca function.
LowCVE-2013-0223SUSE bug 798538SUSE bug 798541cpe:/o:suse:suse-microos:5.0CVE-2013-0228SUSE Linux Enterprise Micro 5.0
The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows guest OS users to gain guest OS privileges via a crafted application.
ModerateCVE-2013-0228SUSE bug 801179cpe:/o:suse:suse-microos:5.0CVE-2013-0268SUSE Linux Enterprise Micro 5.0
The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.
ModerateCVE-2013-0268SUSE bug 802642SUSE bug 841063SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-0290SUSE Linux Enterprise Micro 5.0
The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.
ModerateCVE-2013-0290SUSE bug 803931cpe:/o:suse:suse-microos:5.0CVE-2013-0292SUSE Linux Enterprise Micro 5.0
The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.
ModerateCVE-2013-0292SUSE bug 792095SUSE bug 804392cpe:/o:suse:suse-microos:5.0CVE-2013-0309SUSE Linux Enterprise Micro 5.0
arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.
ModerateCVE-2013-0309SUSE bug 804652SUSE bug 841063cpe:/o:suse:suse-microos:5.0CVE-2013-0310SUSE Linux Enterprise Micro 5.0
The cipso_v4_validate function in net/ipv4/cipso_ipv4.c in the Linux kernel before 3.4.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an IPOPT_CIPSO IP_OPTIONS setsockopt system call.
ModerateCVE-2013-0310SUSE bug 1133087SUSE bug 804653cpe:/o:suse:suse-microos:5.0CVE-2013-0311SUSE Linux Enterprise Micro 5.0
The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges.
ModerateCVE-2013-0311SUSE bug 804656SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-0343SUSE Linux Enterprise Micro 5.0
The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) messages.
LowCVE-2013-0343SUSE bug 805226cpe:/o:suse:suse-microos:5.0CVE-2013-0349SUSE Linux Enterprise Micro 5.0
The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call.
LowCVE-2013-0349SUSE bug 805227SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-0871SUSE Linux Enterprise Micro 5.0
Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death.
ImportantCVE-2013-0871SUSE bug 804154SUSE bug 804227SUSE bug 841063cpe:/o:suse:suse-microos:5.0CVE-2013-0913SUSE Linux Enterprise Micro 5.0
Integer overflow in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel through 3.8.3, as used in Google Chrome OS before 25.0.1364.173 and other products, allows local users to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted application that triggers many relocation copies, and potentially leads to a race condition.
ImportantCVE-2013-0913SUSE bug 808829SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-0914SUSE Linux Enterprise Micro 5.0
The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call.
LowCVE-2013-0914SUSE bug 808827SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-1763SUSE Linux Enterprise Micro 5.0
Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows local users to gain privileges via a large family value in a Netlink message.
ImportantCVE-2013-1763SUSE bug 805633SUSE bug 807436cpe:/o:suse:suse-microos:5.0CVE-2013-1767SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the shmem_remount_fs function in mm/shmem.c in the Linux kernel before 3.7.10 allows local users to gain privileges or cause a denial of service (system crash) by remounting a tmpfs filesystem without specifying a required mpol (aka mempolicy) mount option.
ModerateCVE-2013-1767SUSE bug 806138SUSE bug 807436SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-1772SUSE Linux Enterprise Micro 5.0
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
LowCVE-2013-1772SUSE bug 806238SUSE bug 807441SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-1773SUSE Linux Enterprise Micro 5.0
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.
ModerateCVE-2013-1773SUSE bug 806977SUSE bug 807452cpe:/o:suse:suse-microos:5.0CVE-2013-1774SUSE Linux Enterprise Micro 5.0
The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter.
ModerateCVE-2013-1774SUSE bug 806976SUSE bug 807455SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-1776SUSE Linux Enterprise Micro 5.0
sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
ModerateCVE-2013-1776SUSE bug 806921SUSE bug 817349SUSE bug 817350cpe:/o:suse:suse-microos:5.0CVE-2013-1792SUSE Linux Enterprise Micro 5.0
Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads.
ModerateCVE-2013-1792SUSE bug 807428SUSE bug 808358SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-1796SUSE Linux Enterprise Micro 5.0
The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application.
ModerateCVE-2013-1796SUSE bug 806980SUSE bug 819789SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-1797SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation.
ModerateCVE-2013-1797SUSE bug 806980SUSE bug 819789SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-1819SUSE Linux Enterprise Micro 5.0
The _xfs_buf_find function in fs/xfs/xfs_buf.c in the Linux kernel before 3.7.6 does not validate block numbers, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the ability to mount an XFS filesystem containing a metadata inode with an invalid extent map.
ModerateCVE-2013-1819SUSE bug 807471cpe:/o:suse:suse-microos:5.0CVE-2013-1826SUSE Linux Enterprise Micro 5.0
The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability.
ModerateCVE-2013-1826SUSE bug 809889cpe:/o:suse:suse-microos:5.0CVE-2013-1827SUSE Linux Enterprise Micro 5.0
net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for a certain (1) sender or (2) receiver getsockopt call.
ModerateCVE-2013-1827SUSE bug 811354cpe:/o:suse:suse-microos:5.0CVE-2013-1848SUSE Linux Enterprise Micro 5.0
fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.
ModerateCVE-2013-1848SUSE bug 809155SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-1860SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device.
ModerateCVE-2013-1860SUSE bug 806431SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-1873SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-2634, CVE-2013-2635, CVE-2013-2636. Reason: This candidate is a duplicate of CVE-2013-2634, CVE-2013-2635, and CVE-2013-2636. Notes: All CVE users should reference one or more of CVE-2013-2634, CVE-2013-2635, and CVE-2013-2636 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
LowCVE-2013-1873SUSE bug 810473cpe:/o:suse:suse-microos:5.0CVE-2013-1928SUSE Linux Enterprise Micro 5.0
The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.
ModerateCVE-2013-1928SUSE bug 813735cpe:/o:suse:suse-microos:5.0CVE-2013-1929SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure.
ModerateCVE-2013-1929SUSE bug 813733cpe:/o:suse:suse-microos:5.0CVE-2013-1943SUSE Linux Enterprise Micro 5.0
The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted application, related to arch/x86/kvm/paging_tmpl.h and virt/kvm/kvm_main.c.
ImportantCVE-2013-1943SUSE bug 828012cpe:/o:suse:suse-microos:5.0CVE-2013-1979SUSE Linux Enterprise Micro 5.0
The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application.
ModerateCVE-2013-1979SUSE bug 816708cpe:/o:suse:suse-microos:5.0CVE-2013-1982SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in X.org libXext 1.3.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XcupGetReservedColormapEntries, (2) XcupStoreColors, (3) XdbeGetVisualInfo, (4) XeviGetVisualInfo, (5) XShapeGetRectangles, and (6) XSyncListSystemCounters functions.
ModerateCVE-2013-1982SUSE bug 815451SUSE bug 821665cpe:/o:suse:suse-microos:5.0CVE-2013-1987SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in X.org libXrender 0.9.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XRenderQueryFilters, (2) XRenderQueryFormats, and (3) XRenderQueryPictIndexValues functions.
ModerateCVE-2013-1987SUSE bug 815451SUSE bug 821669SUSE bug 880221cpe:/o:suse:suse-microos:5.0CVE-2013-1989SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in X.org libXv 1.0.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XvQueryPortAttributes, (2) XvListImageFormats, and (3) XvCreateImage function.
ModerateCVE-2013-1989SUSE bug 815451SUSE bug 821671SUSE bug 880221cpe:/o:suse:suse-microos:5.0CVE-2013-2015SUSE Linux Enterprise Micro 5.0
The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journal filesystems, which allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media, as demonstrated by the e2fsprogs tests/f_orphan_extents_inode/image.gz test.
LowCVE-2013-2015SUSE bug 817377cpe:/o:suse:suse-microos:5.0CVE-2013-2066SUSE Linux Enterprise Micro 5.0
Buffer overflow in X.org libXv 1.0.7 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the XvQueryPortAttributes function.
ModerateCVE-2013-2066SUSE bug 815451SUSE bug 821671SUSE bug 880221cpe:/o:suse:suse-microos:5.0CVE-2013-2094SUSE Linux Enterprise Micro 5.0
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
ImportantCVE-2013-2094SUSE bug 819789SUSE bug 820202cpe:/o:suse:suse-microos:5.0CVE-2013-2128SUSE Linux Enterprise Micro 5.0
The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.
ModerateCVE-2013-2128SUSE bug 822583cpe:/o:suse:suse-microos:5.0CVE-2013-2141SUSE Linux Enterprise Micro 5.0
The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call.
LowCVE-2013-2141SUSE bug 823267cpe:/o:suse:suse-microos:5.0CVE-2013-2146SUSE Linux Enterprise Micro 5.0
arch/x86/kernel/cpu/perf_event_intel.c in the Linux kernel before 3.8.9, when the Performance Events Subsystem is enabled, specifies an incorrect bitmask, which allows local users to cause a denial of service (general protection fault and system crash) by attempting to set a reserved bit.
ModerateCVE-2013-2146SUSE bug 825006cpe:/o:suse:suse-microos:5.0CVE-2013-2206SUSE Linux Enterprise Micro 5.0
The sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c in the SCTP implementation in the Linux kernel before 3.8.5 does not properly handle associations during the processing of a duplicate COOKIE ECHO chunk, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted SCTP traffic.
ImportantCVE-2013-2206SUSE bug 781018SUSE bug 826102cpe:/o:suse:suse-microos:5.0CVE-2013-2232SUSE Linux Enterprise Micro 5.0
The ip6_sk_dst_check function in net/ipv6/ip6_output.c in the Linux kernel before 3.10 allows local users to cause a denial of service (system crash) by using an AF_INET6 socket for a connection to an IPv4 interface.
ImportantCVE-2013-2232SUSE bug 827750cpe:/o:suse:suse-microos:5.0CVE-2013-2234SUSE Linux Enterprise Micro 5.0
The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.
LowCVE-2013-2234SUSE bug 827749cpe:/o:suse:suse-microos:5.0CVE-2013-2237SUSE Linux Enterprise Micro 5.0
The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket.
ModerateCVE-2013-2237SUSE bug 828119cpe:/o:suse:suse-microos:5.0CVE-2013-2634SUSE Linux Enterprise Micro 5.0
net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
LowCVE-2013-2634SUSE bug 810473SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-2635SUSE Linux Enterprise Micro 5.0
The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
LowCVE-2013-2635SUSE bug 810473SUSE bug 871595cpe:/o:suse:suse-microos:5.0CVE-2013-2636SUSE Linux Enterprise Micro 5.0
net/bridge/br_mdb.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application.
LowCVE-2013-2636SUSE bug 810473cpe:/o:suse:suse-microos:5.0CVE-2013-2888SUSE Linux Enterprise Micro 5.0
Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
ModerateCVE-2013-2888SUSE bug 835839cpe:/o:suse:suse-microos:5.0CVE-2013-2889SUSE Linux Enterprise Micro 5.0
drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_ZEROPLUS is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
ModerateCVE-2013-2889SUSE bug 835839cpe:/o:suse:suse-microos:5.0CVE-2013-2890SUSE Linux Enterprise Micro 5.0
drivers/hid/hid-sony.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SONY is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
ModerateCVE-2013-2890SUSE bug 835839cpe:/o:suse:suse-microos:5.0CVE-2013-2891SUSE Linux Enterprise Micro 5.0
drivers/hid/hid-steelseries.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_STEELSERIES is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
ModerateCVE-2013-2891SUSE bug 835839cpe:/o:suse:suse-microos:5.0CVE-2013-2892SUSE Linux Enterprise Micro 5.0
drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
ModerateCVE-2013-2892SUSE bug 835839cpe:/o:suse:suse-microos:5.0CVE-2013-2893SUSE Linux Enterprise Micro 5.0
The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device, related to (1) drivers/hid/hid-lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c.
ModerateCVE-2013-2893SUSE bug 835839cpe:/o:suse:suse-microos:5.0CVE-2013-2894SUSE Linux Enterprise Micro 5.0
drivers/hid/hid-lenovo-tpkbd.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LENOVO_TPKBD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
ModerateCVE-2013-2894SUSE bug 835839cpe:/o:suse:suse-microos:5.0CVE-2013-2895SUSE Linux Enterprise Micro 5.0
drivers/hid/hid-logitech-dj.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or obtain sensitive information from kernel memory via a crafted device.
ModerateCVE-2013-2895SUSE bug 835839cpe:/o:suse:suse-microos:5.0CVE-2013-2896SUSE Linux Enterprise Micro 5.0
drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_NTRIG is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device.
ModerateCVE-2013-2896SUSE bug 835839cpe:/o:suse:suse-microos:5.0CVE-2013-2897SUSE Linux Enterprise Micro 5.0
Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate attackers to cause a denial of service (heap memory corruption, or NULL pointer dereference and OOPS) via a crafted device.
ModerateCVE-2013-2897SUSE bug 835839cpe:/o:suse:suse-microos:5.0CVE-2013-2898SUSE Linux Enterprise Micro 5.0
drivers/hid/hid-sensor-hub.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SENSOR_HUB is enabled, allows physically proximate attackers to obtain sensitive information from kernel memory via a crafted device.
ModerateCVE-2013-2898SUSE bug 835839cpe:/o:suse:suse-microos:5.0CVE-2013-2899SUSE Linux Enterprise Micro 5.0
drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PICOLCD is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device.
ModerateCVE-2013-2899SUSE bug 835839cpe:/o:suse:suse-microos:5.0CVE-2013-3076SUSE Linux Enterprise Micro 5.0
The crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c.
ModerateCVE-2013-3076SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3222SUSE Linux Enterprise Micro 5.0
The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3222SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3223SUSE Linux Enterprise Micro 5.0
The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3223SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3224SUSE Linux Enterprise Micro 5.0
The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3224SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3226SUSE Linux Enterprise Micro 5.0
The sco_sock_recvmsg function in net/bluetooth/sco.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3226SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3227SUSE Linux Enterprise Micro 5.0
The caif_seqpkt_recvmsg function in net/caif/caif_socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3227SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3228SUSE Linux Enterprise Micro 5.0
The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3228SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3229SUSE Linux Enterprise Micro 5.0
The iucv_sock_recvmsg function in net/iucv/af_iucv.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3229SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3230SUSE Linux Enterprise Micro 5.0
The l2tp_ip6_recvmsg function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.9-rc7 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3230SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3231SUSE Linux Enterprise Micro 5.0
The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3231SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3232SUSE Linux Enterprise Micro 5.0
The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3232SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3233SUSE Linux Enterprise Micro 5.0
The llcp_sock_recvmsg function in net/nfc/llcp/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable and a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3233SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3234SUSE Linux Enterprise Micro 5.0
The rose_recvmsg function in net/rose/af_rose.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3234SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3235SUSE Linux Enterprise Micro 5.0
net/tipc/socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure and a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3235SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3236SUSE Linux Enterprise Micro 5.0
The vmci_transport_dgram_dequeue function in net/vmw_vsock/vmci_transport.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
ModerateCVE-2013-3236SUSE bug 816668cpe:/o:suse:suse-microos:5.0CVE-2013-3301SUSE Linux Enterprise Micro 5.0
The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and then making an lseek system call.
ModerateCVE-2013-3301SUSE bug 815256cpe:/o:suse:suse-microos:5.0CVE-2013-3495SUSE Linux Enterprise Micro 5.0
The Intel VT-d Interrupt Remapping engine in Xen 3.3.x through 4.3.x allows local guests to cause a denial of service (kernel panic) via a malformed Message Signaled Interrupt (MSI) from a PCI device that is bus mastering capable that triggers a System Error Reporting (SERR) Non-Maskable Interrupt (NMI).
ModerateCVE-2013-3495SUSE bug 826717SUSE bug 903970cpe:/o:suse:suse-microos:5.0CVE-2013-4162SUSE Linux Enterprise Micro 5.0
The udp_v6_push_pending_frames function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel through 3.10.3 makes an incorrect function call for pending data, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.
ModerateCVE-2013-4162SUSE bug 831058cpe:/o:suse:suse-microos:5.0CVE-2013-4163SUSE Linux Enterprise Micro 5.0
The ip6_append_data_mtu function in net/ipv6/ip6_output.c in the IPv6 implementation in the Linux kernel through 3.10.3 does not properly maintain information about whether the IPV6_MTU setsockopt option had been specified, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.
ModerateCVE-2013-4163SUSE bug 831055cpe:/o:suse:suse-microos:5.0CVE-2013-4270SUSE Linux Enterprise Micro 5.0
The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application.
LowCVE-2013-4270SUSE bug 836949cpe:/o:suse:suse-microos:5.0CVE-2013-4282SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.
ImportantCVE-2013-4282SUSE bug 848279cpe:/o:suse:suse-microos:5.0CVE-2013-4288SUSE Linux Enterprise Micro 5.0
Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.
ModerateCVE-2013-4288SUSE bug 1070943SUSE bug 1099031SUSE bug 835827SUSE bug 836931SUSE bug 836932SUSE bug 836937SUSE bug 836939SUSE bug 844967SUSE bug 852368SUSE bug 854144SUSE bug 864716cpe:/o:suse:suse-microos:5.0CVE-2013-4311SUSE Linux Enterprise Micro 5.0
libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
ModerateCVE-2013-4311SUSE bug 836931SUSE bug 838638SUSE bug 864716cpe:/o:suse:suse-microos:5.0CVE-2013-4350SUSE Linux Enterprise Micro 5.0
The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote attackers to obtain sensitive information by sniffing the network.
ModerateCVE-2013-4350SUSE bug 840506cpe:/o:suse:suse-microos:5.0CVE-2013-4387SUSE Linux Enterprise Micro 5.0
net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that triggers a large response packet.
ModerateCVE-2013-4387SUSE bug 843430SUSE bug 848042cpe:/o:suse:suse-microos:5.0CVE-2013-4458SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.
ModerateCVE-2013-4458SUSE bug 1123874SUSE bug 847227SUSE bug 883217SUSE bug 941444SUSE bug 955181SUSE bug 967023SUSE bug 980483cpe:/o:suse:suse-microos:5.0CVE-2013-4483SUSE Linux Enterprise Micro 5.0
The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local users to cause a denial of service (memory consumption or system crash) via a crafted application.
ModerateCVE-2013-4483SUSE bug 848321cpe:/o:suse:suse-microos:5.0CVE-2013-4515SUSE Linux Enterprise Micro 5.0
The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call.
ModerateCVE-2013-4515SUSE bug 849034cpe:/o:suse:suse-microos:5.0CVE-2013-4516SUSE Linux Enterprise Micro 5.0
The mp_get_count function in drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.
ModerateCVE-2013-4516SUSE bug 849036cpe:/o:suse:suse-microos:5.0CVE-2013-4533SUSE Linux Enterprise Micro 5.0
Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.
ImportantCVE-2013-4533SUSE bug 1072223SUSE bug 864655SUSE bug 871442SUSE bug 964644cpe:/o:suse:suse-microos:5.0CVE-2013-4534SUSE Linux Enterprise Micro 5.0
Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements.
ImportantCVE-2013-4534SUSE bug 864811SUSE bug 871442SUSE bug 964452cpe:/o:suse:suse-microos:5.0CVE-2013-4537SUSE Linux Enterprise Micro 5.0
The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.
ImportantCVE-2013-4537SUSE bug 864391SUSE bug 871442SUSE bug 962642cpe:/o:suse:suse-microos:5.0CVE-2013-4538SUSE Linux Enterprise Micro 5.0
Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image.
ImportantCVE-2013-4538SUSE bug 1072223SUSE bug 864769SUSE bug 871442SUSE bug 962335cpe:/o:suse:suse-microos:5.0CVE-2013-4539SUSE Linux Enterprise Micro 5.0
Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image.
ImportantCVE-2013-4539SUSE bug 1072223SUSE bug 864805SUSE bug 871442SUSE bug 962758cpe:/o:suse:suse-microos:5.0CVE-2013-4540SUSE Linux Enterprise Micro 5.0
Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.
ImportantCVE-2013-4540SUSE bug 864801SUSE bug 871442SUSE bug 880751cpe:/o:suse:suse-microos:5.0CVE-2013-4579SUSE Linux Enterprise Micro 5.0
The ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through 3.12 uses a BSSID masking approach to determine the set of MAC addresses on which a Wi-Fi device is listening, which allows remote attackers to discover the original MAC address after spoofing by sending a series of packets to MAC addresses with certain bit manipulations.
ModerateCVE-2013-4579SUSE bug 851426cpe:/o:suse:suse-microos:5.0CVE-2013-4587SUSE Linux Enterprise Micro 5.0
Array index error in the kvm_vm_ioctl_create_vcpu function in virt/kvm/kvm_main.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges via a large id value.
ImportantCVE-2013-4587SUSE bug 853050SUSE bug 882914cpe:/o:suse:suse-microos:5.0CVE-2013-4591SUSE Linux Enterprise Micro 5.0
Buffer overflow in the __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the system.nfs4_acl extended attribute of a pathname on an NFSv4 filesystem.
ModerateCVE-2013-4591SUSE bug 851103cpe:/o:suse:suse-microos:5.0CVE-2013-4592SUSE Linux Enterprise Micro 5.0
Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9 allows local users to cause a denial of service (memory consumption) by leveraging certain device access to trigger movement of memory slots.
LowCVE-2013-4592SUSE bug 851101cpe:/o:suse:suse-microos:5.0CVE-2013-6370SUSE Linux Enterprise Micro 5.0
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.
ModerateCVE-2013-6370SUSE bug 870147cpe:/o:suse:suse-microos:5.0CVE-2013-6371SUSE Linux Enterprise Micro 5.0
The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.
ModerateCVE-2013-6371SUSE bug 870147cpe:/o:suse:suse-microos:5.0CVE-2013-6376SUSE Linux Enterprise Micro 5.0
The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode.
ModerateCVE-2013-6376SUSE bug 853053cpe:/o:suse:suse-microos:5.0CVE-2013-6378SUSE Linux Enterprise Micro 5.0
The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-length write operation.
ModerateCVE-2013-6378SUSE bug 852559cpe:/o:suse:suse-microos:5.0CVE-2013-6381SUSE Linux Enterprise Micro 5.0
Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact via an SNMP ioctl call with a length value that is incompatible with the command-buffer size.
ModerateCVE-2013-6381SUSE bug 852552cpe:/o:suse:suse-microos:5.0CVE-2013-6393SUSE Linux Enterprise Micro 5.0
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.
ModerateCVE-2013-6393SUSE bug 860617SUSE bug 911782cpe:/o:suse:suse-microos:5.0CVE-2013-6763SUSE Linux Enterprise Micro 5.0
The uio_mmap_physical function in drivers/uio/uio.c in the Linux kernel before 3.12 does not validate the size of a memory block, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted mmap operations, a different vulnerability than CVE-2013-4511.
ModerateCVE-2013-6763SUSE bug 850263cpe:/o:suse:suse-microos:5.0CVE-2013-6999SUSE Linux Enterprise Micro 5.0
** DISPUTED ** The IsHandleEntrySecure function in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 SP2 does not properly validate the tagPROCESSINFO pW32Job field, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted NtUserValidateHandleSecure call for an owned object. NOTE: the vendor reportedly disputes the significance of this report, stating that "it appears to be a local DOS ... we don't consider it a security vulnerability."
ImportantCVE-2013-6999cpe:/o:suse:suse-microos:5.0CVE-2013-7263SUSE Linux Enterprise Micro 5.0
The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c.
ImportantCVE-2013-7263SUSE bug 853040SUSE bug 857643cpe:/o:suse:suse-microos:5.0CVE-2013-7264SUSE Linux Enterprise Micro 5.0
The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
ModerateCVE-2013-7264SUSE bug 853040SUSE bug 857643cpe:/o:suse:suse-microos:5.0CVE-2013-7265SUSE Linux Enterprise Micro 5.0
The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
ModerateCVE-2013-7265SUSE bug 853040SUSE bug 857643cpe:/o:suse:suse-microos:5.0CVE-2013-7267SUSE Linux Enterprise Micro 5.0
The atalk_recvmsg function in net/appletalk/ddp.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
ModerateCVE-2013-7267SUSE bug 854722SUSE bug 857643SUSE bug 882914cpe:/o:suse:suse-microos:5.0CVE-2013-7268SUSE Linux Enterprise Micro 5.0
The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
ModerateCVE-2013-7268SUSE bug 854722SUSE bug 857643SUSE bug 882914cpe:/o:suse:suse-microos:5.0CVE-2013-7269SUSE Linux Enterprise Micro 5.0
The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
ModerateCVE-2013-7269SUSE bug 854722SUSE bug 857643SUSE bug 882914cpe:/o:suse:suse-microos:5.0CVE-2013-7270SUSE Linux Enterprise Micro 5.0
The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
ModerateCVE-2013-7270SUSE bug 854722SUSE bug 857643SUSE bug 882914cpe:/o:suse:suse-microos:5.0CVE-2013-7271SUSE Linux Enterprise Micro 5.0
The x25_recvmsg function in net/x25/af_x25.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
ModerateCVE-2013-7271SUSE bug 854722SUSE bug 857643SUSE bug 882914cpe:/o:suse:suse-microos:5.0CVE-2013-7339SUSE Linux Enterprise Micro 5.0
The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.
ModerateCVE-2013-7339SUSE bug 869563cpe:/o:suse:suse-microos:5.0CVE-2013-7446SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel before 4.3.3 allows local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls.
ModerateCVE-2013-7446SUSE bug 1020452SUSE bug 955654SUSE bug 955837cpe:/o:suse:suse-microos:5.0CVE-2013-7470SUSE Linux Enterprise Micro 5.0
cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310.
ImportantCVE-2013-7470SUSE bug 1133087cpe:/o:suse:suse-microos:5.0CVE-2014-0012SUSE Linux Enterprise Micro 5.0
FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.
ModerateCVE-2014-0012SUSE bug 858239cpe:/o:suse:suse-microos:5.0CVE-2014-0038SUSE Linux Enterprise Micro 5.0
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.
ImportantCVE-2014-0038SUSE bug 860993cpe:/o:suse:suse-microos:5.0CVE-2014-0055SUSE Linux Enterprise Micro 5.0
The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors.
ModerateCVE-2014-0055SUSE bug 870173cpe:/o:suse:suse-microos:5.0CVE-2014-0069SUSE Linux Enterprise Micro 5.0
The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.
ImportantCVE-2014-0069SUSE bug 864025cpe:/o:suse:suse-microos:5.0CVE-2014-0077SUSE Linux Enterprise Micro 5.0
drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.
ModerateCVE-2014-0077SUSE bug 870173SUSE bug 870576cpe:/o:suse:suse-microos:5.0CVE-2014-0131SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.
ImportantCVE-2014-0131SUSE bug 824295SUSE bug 867723SUSE bug 869564cpe:/o:suse:suse-microos:5.0CVE-2014-0155SUSE Linux Enterprise Micro 5.0
The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.
ModerateCVE-2014-0155SUSE bug 824295SUSE bug 872540cpe:/o:suse:suse-microos:5.0CVE-2014-0181SUSE Linux Enterprise Micro 5.0
The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program.
ModerateCVE-2014-0181SUSE bug 875051cpe:/o:suse:suse-microos:5.0CVE-2014-0191SUSE Linux Enterprise Micro 5.0
The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.
ImportantCVE-2014-0191SUSE bug 1014873SUSE bug 1123919SUSE bug 876652SUSE bug 877506SUSE bug 996079cpe:/o:suse:suse-microos:5.0CVE-2014-0196SUSE Linux Enterprise Micro 5.0
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
ModerateCVE-2014-0196SUSE bug 871252SUSE bug 875690SUSE bug 877345SUSE bug 879878SUSE bug 933423cpe:/o:suse:suse-microos:5.0CVE-2014-0203SUSE Linux Enterprise Micro 5.0
The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.
ModerateCVE-2014-0203SUSE bug 883526cpe:/o:suse:suse-microos:5.0CVE-2014-0222SUSE Linux Enterprise Micro 5.0
Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.
ModerateCVE-2014-0222SUSE bug 1072223SUSE bug 877642SUSE bug 950367SUSE bug 964925cpe:/o:suse:suse-microos:5.0CVE-2014-0223SUSE Linux Enterprise Micro 5.0
Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.
ModerateCVE-2014-0223SUSE bug 877645cpe:/o:suse:suse-microos:5.0CVE-2014-1569SUSE Linux Enterprise Micro 5.0
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.
ImportantCVE-2014-1569SUSE bug 910647SUSE bug 913096SUSE bug 917597cpe:/o:suse:suse-microos:5.0CVE-2014-1737SUSE Linux Enterprise Micro 5.0
The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device.
ImportantCVE-2014-1737SUSE bug 1115893SUSE bug 875798SUSE bug 877345cpe:/o:suse:suse-microos:5.0CVE-2014-1738SUSE Linux Enterprise Micro 5.0
The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device.
ImportantCVE-2014-1738SUSE bug 875798SUSE bug 877345cpe:/o:suse:suse-microos:5.0CVE-2014-2039SUSE Linux Enterprise Micro 5.0
arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction.
ModerateCVE-2014-2039SUSE bug 862796SUSE bug 865307cpe:/o:suse:suse-microos:5.0CVE-2014-2240SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.
ImportantCVE-2014-2240SUSE bug 867620SUSE bug 916867cpe:/o:suse:suse-microos:5.0CVE-2014-2309SUSE Linux Enterprise Micro 5.0
The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets.
ImportantCVE-2014-2309SUSE bug 824295SUSE bug 867531cpe:/o:suse:suse-microos:5.0CVE-2014-2525SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.
ModerateCVE-2014-2525SUSE bug 868944SUSE bug 911782cpe:/o:suse:suse-microos:5.0CVE-2014-2532SUSE Linux Enterprise Micro 5.0
sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.
ModerateCVE-2014-2532SUSE bug 1074631SUSE bug 869101SUSE bug 890850SUSE bug 916239SUSE bug 996040cpe:/o:suse:suse-microos:5.0CVE-2014-2672SUSE Linux Enterprise Micro 5.0
Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions.
ImportantCVE-2014-2672SUSE bug 871148cpe:/o:suse:suse-microos:5.0CVE-2014-2678SUSE Linux Enterprise Micro 5.0
The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.
ModerateCVE-2014-2678SUSE bug 871561cpe:/o:suse:suse-microos:5.0CVE-2014-2706SUSE Linux Enterprise Micro 5.0
Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c.
ImportantCVE-2014-2706SUSE bug 1115893SUSE bug 871797cpe:/o:suse:suse-microos:5.0CVE-2014-3122SUSE Linux Enterprise Micro 5.0
The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires removal of page-table mappings.
ModerateCVE-2014-3122SUSE bug 824295SUSE bug 876102cpe:/o:suse:suse-microos:5.0CVE-2014-3144SUSE Linux Enterprise Micro 5.0
The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced.
ModerateCVE-2014-3144SUSE bug 824295SUSE bug 877257SUSE bug 889071cpe:/o:suse:suse-microos:5.0CVE-2014-3145SUSE Linux Enterprise Micro 5.0
The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced.
ImportantCVE-2014-3145SUSE bug 824295SUSE bug 877257cpe:/o:suse:suse-microos:5.0CVE-2014-3153SUSE Linux Enterprise Micro 5.0
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
ImportantCVE-2014-3153SUSE bug 877775SUSE bug 880892SUSE bug 882228cpe:/o:suse:suse-microos:5.0CVE-2014-3181SUSE Linux Enterprise Micro 5.0
Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event.
ModerateCVE-2014-3181SUSE bug 896382cpe:/o:suse:suse-microos:5.0CVE-2014-3184SUSE Linux Enterprise Micro 5.0
The report_fixup functions in the HID subsystem in the Linux kernel before 3.16.2 might allow physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c.
ModerateCVE-2014-3184SUSE bug 896390cpe:/o:suse:suse-microos:5.0CVE-2014-3185SUSE Linux Enterprise Micro 5.0
Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.
ModerateCVE-2014-3185SUSE bug 896391cpe:/o:suse:suse-microos:5.0CVE-2014-3186SUSE Linux Enterprise Micro 5.0
Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report.
ModerateCVE-2014-3186SUSE bug 896392cpe:/o:suse:suse-microos:5.0CVE-2014-3461SUSE Linux Enterprise Micro 5.0
hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a heap-based buffer overflow, related to "USB post load checks."
ModerateCVE-2014-3461SUSE bug 878541cpe:/o:suse:suse-microos:5.0CVE-2014-3513SUSE Linux Enterprise Micro 5.0
Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message.
ModerateCVE-2014-3513SUSE bug 901277cpe:/o:suse:suse-microos:5.0CVE-2014-3567SUSE Linux Enterprise Micro 5.0
Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure.
ImportantCVE-2014-3567SUSE bug 877506SUSE bug 901277SUSE bug 905106cpe:/o:suse:suse-microos:5.0CVE-2014-3568SUSE Linux Enterprise Micro 5.0
OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c.
ModerateCVE-2014-3568SUSE bug 901277SUSE bug 905106SUSE bug 911399SUSE bug 986238cpe:/o:suse:suse-microos:5.0CVE-2014-3569SUSE Linux Enterprise Micro 5.0
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue became relevant after the CVE-2014-3568 fix.
ModerateCVE-2014-3569SUSE bug 911399SUSE bug 927623SUSE bug 986238cpe:/o:suse:suse-microos:5.0CVE-2014-3570SUSE Linux Enterprise Micro 5.0
The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.
ModerateCVE-2014-3570SUSE bug 912296SUSE bug 915848SUSE bug 927623SUSE bug 937891SUSE bug 944456cpe:/o:suse:suse-microos:5.0CVE-2014-3571SUSE Linux Enterprise Micro 5.0
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.
ModerateCVE-2014-3571SUSE bug 912294SUSE bug 915848SUSE bug 927623cpe:/o:suse:suse-microos:5.0CVE-2014-3572SUSE Linux Enterprise Micro 5.0
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.
ModerateCVE-2014-3572SUSE bug 912015SUSE bug 915848SUSE bug 927623SUSE bug 937891cpe:/o:suse:suse-microos:5.0CVE-2014-3591SUSE Linux Enterprise Micro 5.0
Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.
ModerateCVE-2014-3591SUSE bug 920057SUSE bug 949135cpe:/o:suse:suse-microos:5.0CVE-2014-3601SUSE Linux Enterprise Micro 5.0
The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages.
ModerateCVE-2014-3601SUSE bug 892782SUSE bug 902675cpe:/o:suse:suse-microos:5.0CVE-2014-3610SUSE Linux Enterprise Micro 5.0
The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c.
ModerateCVE-2014-3610SUSE bug 899192cpe:/o:suse:suse-microos:5.0CVE-2014-3631SUSE Linux Enterprise Micro 5.0
The assoc_array_gc function in the associative-array implementation in lib/assoc_array.c in the Linux kernel before 3.16.3 does not properly implement garbage collection, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via multiple "keyctl newring" operations followed by a "keyctl timeout" operation.
ImportantCVE-2014-3631SUSE bug 896262cpe:/o:suse:suse-microos:5.0CVE-2014-3636SUSE Linux Enterprise Micro 5.0
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.
ModerateCVE-2014-3636SUSE bug 896453SUSE bug 904017cpe:/o:suse:suse-microos:5.0CVE-2014-3637SUSE Linux Enterprise Micro 5.0
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.
ModerateCVE-2014-3637SUSE bug 896453cpe:/o:suse:suse-microos:5.0CVE-2014-3639SUSE Linux Enterprise Micro 5.0
The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.
ModerateCVE-2014-3639SUSE bug 896453SUSE bug 903055SUSE bug 903057cpe:/o:suse:suse-microos:5.0CVE-2014-3640SUSE Linux Enterprise Micro 5.0
The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.
CVE-2014-3640SUSE bug 897654SUSE bug 965112cpe:/o:suse:suse-microos:5.0CVE-2014-3646SUSE Linux Enterprise Micro 5.0
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
ModerateCVE-2014-3646SUSE bug 899192cpe:/o:suse:suse-microos:5.0CVE-2014-3660SUSE Linux Enterprise Micro 5.0
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
ModerateCVE-2014-3660SUSE bug 1123919SUSE bug 901546cpe:/o:suse:suse-microos:5.0CVE-2014-3672SUSE Linux Enterprise Micro 5.0
The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr.
LowCVE-2014-3672SUSE bug 981264cpe:/o:suse:suse-microos:5.0CVE-2014-3673SUSE Linux Enterprise Micro 5.0
The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c.
ModerateCVE-2014-3673SUSE bug 1115893SUSE bug 902346SUSE bug 902349SUSE bug 904899cpe:/o:suse:suse-microos:5.0CVE-2014-3675SUSE Linux Enterprise Micro 5.0
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.
ImportantCVE-2014-3675SUSE bug 889332cpe:/o:suse:suse-microos:5.0CVE-2014-3676SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."
ImportantCVE-2014-3676SUSE bug 889332cpe:/o:suse:suse-microos:5.0CVE-2014-3677SUSE Linux Enterprise Micro 5.0
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.
ImportantCVE-2014-3677SUSE bug 889332cpe:/o:suse:suse-microos:5.0CVE-2014-3686SUSE Linux Enterprise Micro 5.0
wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.
ModerateCVE-2014-3686SUSE bug 1063667SUSE bug 900611SUSE bug 915323cpe:/o:suse:suse-microos:5.0CVE-2014-3687SUSE Linux Enterprise Micro 5.0
The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.
ImportantCVE-2014-3687SUSE bug 1115893SUSE bug 902349SUSE bug 904899SUSE bug 909208cpe:/o:suse:suse-microos:5.0CVE-2014-3688SUSE Linux Enterprise Micro 5.0
The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c.
ModerateCVE-2014-3688SUSE bug 902351cpe:/o:suse:suse-microos:5.0CVE-2014-3690SUSE Linux Enterprise Micro 5.0
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.
ModerateCVE-2014-3690SUSE bug 902232cpe:/o:suse:suse-microos:5.0CVE-2014-3710SUSE Linux Enterprise Micro 5.0
The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.
ModerateCVE-2014-3710SUSE bug 902367SUSE bug 910252cpe:/o:suse:suse-microos:5.0CVE-2014-3917SUSE Linux Enterprise Micro 5.0
kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number.
ModerateCVE-2014-3917SUSE bug 880484cpe:/o:suse:suse-microos:5.0CVE-2014-4040SUSE Linux Enterprise Micro 5.0
snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.
ModerateCVE-2014-4040SUSE bug 883174cpe:/o:suse:suse-microos:5.0CVE-2014-4157SUSE Linux Enterprise Micro 5.0
arch/mips/include/asm/thread_info.h in the Linux kernel before 3.14.8 on the MIPS platform does not configure _TIF_SECCOMP checks on the fast system-call path, which allows local users to bypass intended PR_SET_SECCOMP restrictions by executing a crafted application without invoking a trace or audit subsystem.
ModerateCVE-2014-4157SUSE bug 987709SUSE bug 994755cpe:/o:suse:suse-microos:5.0CVE-2014-4171SUSE Linux Enterprise Micro 5.0
mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call.
ModerateCVE-2014-4171SUSE bug 883518cpe:/o:suse:suse-microos:5.0CVE-2014-4508SUSE Linux Enterprise Micro 5.0
arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.
ImportantCVE-2014-4508SUSE bug 883724cpe:/o:suse:suse-microos:5.0CVE-2014-4607SUSE Linux Enterprise Micro 5.0
Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.
ImportantCVE-2014-4607SUSE bug 883947cpe:/o:suse:suse-microos:5.0CVE-2014-4608SUSE Linux Enterprise Micro 5.0
** DISPUTED ** Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says "the Linux kernel is *not* affected; media hype."
ModerateCVE-2014-4608SUSE bug 883948cpe:/o:suse:suse-microos:5.0CVE-2014-4611SUSE Linux Enterprise Micro 5.0
Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715.
ModerateCVE-2014-4611SUSE bug 883949SUSE bug 885389cpe:/o:suse:suse-microos:5.0CVE-2014-4650SUSE Linux Enterprise Micro 5.0
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
ModerateCVE-2014-4650SUSE bug 856835SUSE bug 856836SUSE bug 863741SUSE bug 885882SUSE bug 898572SUSE bug 912739cpe:/o:suse:suse-microos:5.0CVE-2014-4667SUSE Linux Enterprise Micro 5.0
The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet.
ModerateCVE-2014-4667SUSE bug 885422cpe:/o:suse:suse-microos:5.0CVE-2014-4715SUSE Linux Enterprise Micro 5.0
Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect integer overflows, which allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run, a different vulnerability than CVE-2014-4611.
ModerateCVE-2014-4715cpe:/o:suse:suse-microos:5.0CVE-2014-4943SUSE Linux Enterprise Micro 5.0
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
ModerateCVE-2014-4943SUSE bug 887082cpe:/o:suse:suse-microos:5.0CVE-2014-5033SUSE Linux Enterprise Micro 5.0
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."
ModerateCVE-2014-5033SUSE bug 864716SUSE bug 912121cpe:/o:suse:suse-microos:5.0CVE-2014-5045SUSE Linux Enterprise Micro 5.0
The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount system call in conjunction with a symlink, which allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have unspecified other impact via the umount program.
ModerateCVE-2014-5045SUSE bug 889060cpe:/o:suse:suse-microos:5.0CVE-2014-5077SUSE Linux Enterprise Micro 5.0
The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.
ImportantCVE-2014-5077SUSE bug 889173cpe:/o:suse:suse-microos:5.0CVE-2014-5277SUSE Linux Enterprise Micro 5.0
Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
ModerateCVE-2014-5277SUSE bug 904165cpe:/o:suse:suse-microos:5.0CVE-2014-5351SUSE Linux Enterprise Micro 5.0
The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access.
ModerateCVE-2014-5351SUSE bug 897874cpe:/o:suse:suse-microos:5.0CVE-2014-5352SUSE Linux Enterprise Micro 5.0
The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind.
ModerateCVE-2014-5352SUSE bug 1005509SUSE bug 770172SUSE bug 912002cpe:/o:suse:suse-microos:5.0CVE-2014-5353SUSE Linux Enterprise Micro 5.0
The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.
LowCVE-2014-5353SUSE bug 910457cpe:/o:suse:suse-microos:5.0CVE-2014-5354SUSE Linux Enterprise Micro 5.0
plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command.
LowCVE-2014-5354SUSE bug 910458cpe:/o:suse:suse-microos:5.0CVE-2014-5355SUSE Linux Enterprise Micro 5.0
MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.
ModerateCVE-2014-5355SUSE bug 770172SUSE bug 918595cpe:/o:suse:suse-microos:5.0CVE-2014-5471SUSE Linux Enterprise Micro 5.0
Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry.
ModerateCVE-2014-5471SUSE bug 892490cpe:/o:suse:suse-microos:5.0CVE-2014-5472SUSE Linux Enterprise Micro 5.0
The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry.
ModerateCVE-2014-5472SUSE bug 892490cpe:/o:suse:suse-microos:5.0CVE-2014-6272SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_expand, or (3) bufferevent_write function, which triggers a heap-based buffer overflow or an infinite loop. NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2015-6525 for the functions that are only affected in 2.0 and later.
LowCVE-2014-6272SUSE bug 897243SUSE bug 943011SUSE bug 947373cpe:/o:suse:suse-microos:5.0CVE-2014-6407SUSE Linux Enterprise Micro 5.0
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
ModerateCVE-2014-6407SUSE bug 907012cpe:/o:suse:suse-microos:5.0CVE-2014-6408SUSE Linux Enterprise Micro 5.0
Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.
ModerateCVE-2014-6408SUSE bug 907014cpe:/o:suse:suse-microos:5.0CVE-2014-6410SUSE Linux Enterprise Micro 5.0
The __udf_read_inode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection, which allows physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode.
ModerateCVE-2014-6410SUSE bug 896689cpe:/o:suse:suse-microos:5.0CVE-2014-6418SUSE Linux Enterprise Micro 5.0
net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly validate auth replies, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via crafted data from the IP address of a Ceph Monitor.
ImportantCVE-2014-6418SUSE bug 896384cpe:/o:suse:suse-microos:5.0CVE-2014-7202SUSE Linux Enterprise Micro 5.0
stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request.
ModerateCVE-2014-7202SUSE bug 898917cpe:/o:suse:suse-microos:5.0CVE-2014-7203SUSE Linux Enterprise Micro 5.0
libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors.
ModerateCVE-2014-7203SUSE bug 898917cpe:/o:suse:suse-microos:5.0CVE-2014-7207SUSE Linux Enterprise Micro 5.0
A certain Debian patch to the IPv6 implementation in the Linux kernel 3.2.x through 3.2.63 does not properly validate arguments in ipv6_select_ident function calls, which allows local users to cause a denial of service (NULL pointer dereference and system crash) by leveraging (1) tun or (2) macvtap device access.
ModerateCVE-2014-7207SUSE bug 1139403SUSE bug 902351cpe:/o:suse:suse-microos:5.0CVE-2014-7283SUSE Linux Enterprise Micro 5.0
The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of service (filesystem corruption, and OOPS or panic) via operations on directories that have hash collisions, as demonstrated by rmdir operations.
ModerateCVE-2014-7283SUSE bug 899480cpe:/o:suse:suse-microos:5.0CVE-2014-7815SUSE Linux Enterprise Micro 5.0
The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.
ModerateCVE-2014-7815SUSE bug 902737SUSE bug 962627cpe:/o:suse:suse-microos:5.0CVE-2014-7817SUSE Linux Enterprise Micro 5.0
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".
ModerateCVE-2014-7817SUSE bug 906371cpe:/o:suse:suse-microos:5.0CVE-2014-7822SUSE Linux Enterprise Micro 5.0
The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem.
ModerateCVE-2014-7822SUSE bug 1115893SUSE bug 915322SUSE bug 915517SUSE bug 939240cpe:/o:suse:suse-microos:5.0CVE-2014-7823SUSE Linux Enterprise Micro 5.0
The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.
ModerateCVE-2014-7823SUSE bug 904176cpe:/o:suse:suse-microos:5.0CVE-2014-7824SUSE Linux Enterprise Micro 5.0
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
ModerateCVE-2014-7824SUSE bug 904017cpe:/o:suse:suse-microos:5.0CVE-2014-7840SUSE Linux Enterprise Micro 5.0
The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.
ModerateCVE-2014-7840SUSE bug 905097cpe:/o:suse:suse-microos:5.0CVE-2014-7842SUSE Linux Enterprise Micro 5.0
Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313.
ModerateCVE-2014-7842SUSE bug 905312SUSE bug 907822cpe:/o:suse:suse-microos:5.0CVE-2014-7970SUSE Linux Enterprise Micro 5.0
The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.
ModerateCVE-2014-7970SUSE bug 900644cpe:/o:suse:suse-microos:5.0CVE-2014-7975SUSE Linux Enterprise Micro 5.0
The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call.
ModerateCVE-2014-7975SUSE bug 900392cpe:/o:suse:suse-microos:5.0CVE-2014-8086SUSE Linux Enterprise Micro 5.0
Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag.
ModerateCVE-2014-8086SUSE bug 900881cpe:/o:suse:suse-microos:5.0CVE-2014-8106SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for CVE-2007-1320.
ModerateCVE-2014-8106SUSE bug 1023004SUSE bug 1178658SUSE bug 907805cpe:/o:suse:suse-microos:5.0CVE-2014-8116SUSE Linux Enterprise Micro 5.0
The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities.
ModerateCVE-2014-8116SUSE bug 910252SUSE bug 910253SUSE bug 917152cpe:/o:suse:suse-microos:5.0CVE-2014-8117SUSE Linux Enterprise Micro 5.0
softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumption or crash) via unspecified vectors.
ModerateCVE-2014-8117SUSE bug 910252SUSE bug 910253SUSE bug 917152cpe:/o:suse:suse-microos:5.0CVE-2014-8119SUSE Linux Enterprise Micro 5.0
The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path expressions.
ImportantCVE-2014-8119SUSE bug 925225cpe:/o:suse:suse-microos:5.0CVE-2014-8121SUSE Linux Enterprise Micro 5.0
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.
ModerateCVE-2014-8121SUSE bug 1123874SUSE bug 918187SUSE bug 945779cpe:/o:suse:suse-microos:5.0CVE-2014-8131SUSE Linux Enterprise Micro 5.0
The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access.
LowCVE-2014-8131SUSE bug 909274cpe:/o:suse:suse-microos:5.0CVE-2014-8132SUSE Linux Enterprise Micro 5.0
Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet.
ModerateCVE-2014-8132SUSE bug 910790SUSE bug 928323cpe:/o:suse:suse-microos:5.0CVE-2014-8133SUSE Linux Enterprise Micro 5.0
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value.
LowCVE-2014-8133SUSE bug 817142SUSE bug 906545SUSE bug 907818SUSE bug 909077cpe:/o:suse:suse-microos:5.0CVE-2014-8134SUSE Linux Enterprise Micro 5.0
The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.
LowCVE-2014-8134SUSE bug 907818SUSE bug 909077SUSE bug 909078cpe:/o:suse:suse-microos:5.0CVE-2014-8148SUSE Linux Enterprise Micro 5.0
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.
ImportantCVE-2014-8148SUSE bug 912023cpe:/o:suse:suse-microos:5.0CVE-2014-8150SUSE Linux Enterprise Micro 5.0
CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.
ModerateCVE-2014-8150SUSE bug 911363SUSE bug 951391cpe:/o:suse:suse-microos:5.0CVE-2014-8160SUSE Linux Enterprise Micro 5.0
net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers.
ImportantCVE-2014-8160SUSE bug 857643SUSE bug 913059cpe:/o:suse:suse-microos:5.0CVE-2014-8178SUSE Linux Enterprise Micro 5.0
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.
ImportantCVE-2014-8178SUSE bug 949660cpe:/o:suse:suse-microos:5.0CVE-2014-8179SUSE Linux Enterprise Micro 5.0
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
ImportantCVE-2014-8179SUSE bug 949660cpe:/o:suse:suse-microos:5.0CVE-2014-8242SUSE Linux Enterprise Micro 5.0
librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.
LowCVE-2014-8242SUSE bug 900914SUSE bug 922710cpe:/o:suse:suse-microos:5.0CVE-2014-8275SUSE Linux Enterprise Micro 5.0
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.
ModerateCVE-2014-8275SUSE bug 912018SUSE bug 915848SUSE bug 927623SUSE bug 937891cpe:/o:suse:suse-microos:5.0CVE-2014-8369SUSE Linux Enterprise Micro 5.0
The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601.
ImportantCVE-2014-8369SUSE bug 892782SUSE bug 902675cpe:/o:suse:suse-microos:5.0CVE-2014-8559SUSE Linux Enterprise Micro 5.0
The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to cause a denial of service (deadlock and system hang) via a crafted application.
ModerateCVE-2014-8559SUSE bug 903640SUSE bug 915517cpe:/o:suse:suse-microos:5.0CVE-2014-8564SUSE Linux Enterprise Micro 5.0
The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.
ModerateCVE-2014-8564SUSE bug 904603cpe:/o:suse:suse-microos:5.0CVE-2014-8709SUSE Linux Enterprise Micro 5.0
The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets.
ImportantCVE-2014-8709SUSE bug 904700cpe:/o:suse:suse-microos:5.0CVE-2014-8884SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.
ModerateCVE-2014-8884SUSE bug 904876SUSE bug 905522SUSE bug 905739SUSE bug 905744SUSE bug 905748SUSE bug 905764cpe:/o:suse:suse-microos:5.0CVE-2014-8964SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats.
ModerateCVE-2014-8964SUSE bug 906574SUSE bug 924960SUSE bug 933288SUSE bug 936408SUSE bug 958373cpe:/o:suse:suse-microos:5.0CVE-2014-9087SUSE Linux Enterprise Micro 5.0
Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.
ImportantCVE-2014-9087SUSE bug 907074SUSE bug 926826SUSE bug 996084cpe:/o:suse:suse-microos:5.0CVE-2014-9092SUSE Linux Enterprise Micro 5.0
libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker.
ModerateCVE-2014-9092SUSE bug 906761cpe:/o:suse:suse-microos:5.0CVE-2014-9112SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.
ModerateCVE-2014-9112SUSE bug 907456SUSE bug 913479cpe:/o:suse:suse-microos:5.0CVE-2014-9114SUSE Linux Enterprise Micro 5.0
Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.
ImportantCVE-2014-9114SUSE bug 907434SUSE bug 908742cpe:/o:suse:suse-microos:5.0CVE-2014-9130SUSE Linux Enterprise Micro 5.0
scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.
ModerateCVE-2014-9130SUSE bug 907809SUSE bug 911782SUSE bug 921588cpe:/o:suse:suse-microos:5.0CVE-2014-9356SUSE Linux Enterprise Micro 5.0
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
CriticalCVE-2014-9356SUSE bug 909712SUSE bug 909747cpe:/o:suse:suse-microos:5.0CVE-2014-9357SUSE Linux Enterprise Micro 5.0
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.
CriticalCVE-2014-9357SUSE bug 909710SUSE bug 909747cpe:/o:suse:suse-microos:5.0CVE-2014-9358SUSE Linux Enterprise Micro 5.0
Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."
ModerateCVE-2014-9358SUSE bug 909709SUSE bug 909747cpe:/o:suse:suse-microos:5.0CVE-2014-9402SUSE Linux Enterprise Micro 5.0
The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process.
ImportantCVE-2014-9402SUSE bug 910599cpe:/o:suse:suse-microos:5.0CVE-2014-9419SUSE Linux Enterprise Micro 5.0
The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address.
LowCVE-2014-9419SUSE bug 911326cpe:/o:suse:suse-microos:5.0CVE-2014-9420SUSE Linux Enterprise Micro 5.0
The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image.
LowCVE-2014-9420SUSE bug 906545SUSE bug 911325cpe:/o:suse:suse-microos:5.0CVE-2014-9421SUSE Linux Enterprise Micro 5.0
The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind.
ModerateCVE-2014-9421SUSE bug 1005509SUSE bug 770172SUSE bug 912002cpe:/o:suse:suse-microos:5.0CVE-2014-9422SUSE Linux Enterprise Micro 5.0
The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal.
ModerateCVE-2014-9422SUSE bug 1005509SUSE bug 770172SUSE bug 912002cpe:/o:suse:suse-microos:5.0CVE-2014-9423SUSE Linux Enterprise Micro 5.0
The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field.
ModerateCVE-2014-9423SUSE bug 1005509SUSE bug 912002cpe:/o:suse:suse-microos:5.0CVE-2014-9447SUSE Linux Enterprise Micro 5.0
Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program.
ModerateCVE-2014-9447SUSE bug 911662SUSE bug 912408cpe:/o:suse:suse-microos:5.0CVE-2014-9488SUSE Linux Enterprise Micro 5.0
The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.
ModerateCVE-2014-9488SUSE bug 921719cpe:/o:suse:suse-microos:5.0CVE-2014-9512SUSE Linux Enterprise Micro 5.0
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
ModerateCVE-2014-9512SUSE bug 915410SUSE bug 960191cpe:/o:suse:suse-microos:5.0CVE-2014-9556SUSE Linux Enterprise Micro 5.0
Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop.
ModerateCVE-2014-9556SUSE bug 912214SUSE bug 919283SUSE bug 934533cpe:/o:suse:suse-microos:5.0CVE-2014-9584SUSE Linux Enterprise Micro 5.0
The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image.
ModerateCVE-2014-9584SUSE bug 912654cpe:/o:suse:suse-microos:5.0CVE-2014-9585SUSE Linux Enterprise Micro 5.0
The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD.
ImportantCVE-2014-9585SUSE bug 912705cpe:/o:suse:suse-microos:5.0CVE-2014-9656SUSE Linux Enterprise Micro 5.0
The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font.
ModerateCVE-2014-9656SUSE bug 916847cpe:/o:suse:suse-microos:5.0CVE-2014-9657SUSE Linux Enterprise Micro 5.0
The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.
ModerateCVE-2014-9657SUSE bug 916856cpe:/o:suse:suse-microos:5.0CVE-2014-9658SUSE Linux Enterprise Micro 5.0
The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.
ModerateCVE-2014-9658SUSE bug 916857cpe:/o:suse:suse-microos:5.0CVE-2014-9659SUSE Linux Enterprise Micro 5.0
cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2240.
ModerateCVE-2014-9659SUSE bug 916867cpe:/o:suse:suse-microos:5.0CVE-2014-9660SUSE Linux Enterprise Micro 5.0
The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.
ModerateCVE-2014-9660SUSE bug 916858cpe:/o:suse:suse-microos:5.0CVE-2014-9661SUSE Linux Enterprise Micro 5.0
type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.
ModerateCVE-2014-9661SUSE bug 916859cpe:/o:suse:suse-microos:5.0CVE-2014-9662SUSE Linux Enterprise Micro 5.0
cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font.
ModerateCVE-2014-9662SUSE bug 916860cpe:/o:suse:suse-microos:5.0CVE-2014-9663SUSE Linux Enterprise Micro 5.0
The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.
ModerateCVE-2014-9663SUSE bug 916865cpe:/o:suse:suse-microos:5.0CVE-2014-9664SUSE Linux Enterprise Micro 5.0
FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c.
ModerateCVE-2014-9664SUSE bug 916864cpe:/o:suse:suse-microos:5.0CVE-2014-9665SUSE Linux Enterprise Micro 5.0
The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file.
ModerateCVE-2014-9665SUSE bug 916863cpe:/o:suse:suse-microos:5.0CVE-2014-9666SUSE Linux Enterprise Micro 5.0
The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.
ModerateCVE-2014-9666SUSE bug 916862cpe:/o:suse:suse-microos:5.0CVE-2014-9667SUSE Linux Enterprise Micro 5.0
sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table.
ModerateCVE-2014-9667SUSE bug 916861cpe:/o:suse:suse-microos:5.0CVE-2014-9668SUSE Linux Enterprise Micro 5.0
The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Web Open Font Format (WOFF) file.
ModerateCVE-2014-9668SUSE bug 916868cpe:/o:suse:suse-microos:5.0CVE-2014-9669SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table.
ModerateCVE-2014-9669SUSE bug 916870cpe:/o:suse:suse-microos:5.0CVE-2014-9670SUSE Linux Enterprise Micro 5.0
Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row.
ModerateCVE-2014-9670SUSE bug 916871SUSE bug 933247cpe:/o:suse:suse-microos:5.0CVE-2014-9671SUSE Linux Enterprise Micro 5.0
Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.
ModerateCVE-2014-9671SUSE bug 916872SUSE bug 933247cpe:/o:suse:suse-microos:5.0CVE-2014-9672SUSE Linux Enterprise Micro 5.0
Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file.
ModerateCVE-2014-9672SUSE bug 916873cpe:/o:suse:suse-microos:5.0CVE-2014-9673SUSE Linux Enterprise Micro 5.0
Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.
ModerateCVE-2014-9673SUSE bug 916874cpe:/o:suse:suse-microos:5.0CVE-2014-9674SUSE Linux Enterprise Micro 5.0
The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.
ModerateCVE-2014-9674SUSE bug 916879cpe:/o:suse:suse-microos:5.0CVE-2014-9675SUSE Linux Enterprise Micro 5.0
bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.
ModerateCVE-2014-9675SUSE bug 916881cpe:/o:suse:suse-microos:5.0CVE-2014-9680SUSE Linux Enterprise Micro 5.0
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.
LowCVE-2014-9680SUSE bug 917806SUSE bug 919737SUSE bug 921999SUSE bug 953359cpe:/o:suse:suse-microos:5.0CVE-2014-9710SUSE Linux Enterprise Micro 5.0
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.
ModerateCVE-2014-9710SUSE bug 923908SUSE bug 939260cpe:/o:suse:suse-microos:5.0CVE-2014-9717SUSE Linux Enterprise Micro 5.0
fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 within a user namespace.
LowCVE-2014-9717SUSE bug 928547cpe:/o:suse:suse-microos:5.0CVE-2014-9721SUSE Linux Enterprise Micro 5.0
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
ModerateCVE-2014-9721SUSE bug 931978cpe:/o:suse:suse-microos:5.0CVE-2014-9728SUSE Linux Enterprise Micro 5.0
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c.
LowCVE-2014-9728SUSE bug 911325SUSE bug 933904cpe:/o:suse:suse-microos:5.0CVE-2014-9729SUSE Linux Enterprise Micro 5.0
The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.18.2 does not ensure a certain data-structure size consistency, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.
LowCVE-2014-9729SUSE bug 911325SUSE bug 933904cpe:/o:suse:suse-microos:5.0CVE-2014-9730SUSE Linux Enterprise Micro 5.0
The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.
LowCVE-2014-9730SUSE bug 911325SUSE bug 933904cpe:/o:suse:suse-microos:5.0CVE-2014-9731SUSE Linux Enterprise Micro 5.0
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's name along with a trailing \0 character, which allows local users to obtain sensitive information via a crafted filesystem image, related to fs/udf/symlink.c and fs/udf/unicode.c.
LowCVE-2014-9731SUSE bug 911325SUSE bug 933896cpe:/o:suse:suse-microos:5.0CVE-2014-9761SUSE Linux Enterprise Micro 5.0
Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function.
CriticalCVE-2014-9761SUSE bug 1123874SUSE bug 962738SUSE bug 986086cpe:/o:suse:suse-microos:5.0CVE-2014-9766SUSE Linux Enterprise Micro 5.0
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.
ModerateCVE-2014-9766SUSE bug 968090cpe:/o:suse:suse-microos:5.0CVE-2014-9904SUSE Linux Enterprise Micro 5.0
The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.
ModerateCVE-2014-9904SUSE bug 986811SUSE bug 986941cpe:/o:suse:suse-microos:5.0CVE-2014-9914SUSE Linux Enterprise Micro 5.0
Race condition in the ip4_datagram_release_cb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect expectations about locking during multithreaded access to internal data structures for IPv4 UDP sockets.
ModerateCVE-2014-9914SUSE bug 1023997cpe:/o:suse:suse-microos:5.0CVE-2014-9922SUSE Linux Enterprise Micro 5.0
The eCryptfs subsystem in the Linux kernel before 3.18 allows local users to gain privileges via a large filesystem stack that includes an overlayfs layer, related to fs/ecryptfs/main.c and fs/overlayfs/super.c.
ModerateCVE-2014-9922SUSE bug 1032340cpe:/o:suse:suse-microos:5.0CVE-2015-0204SUSE Linux Enterprise Micro 5.0
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.
CriticalCVE-2015-0204SUSE bug 912014SUSE bug 920482SUSE bug 920484SUSE bug 927591SUSE bug 927623SUSE bug 936787SUSE bug 952088cpe:/o:suse:suse-microos:5.0CVE-2015-0205SUSE Linux Enterprise Micro 5.0
The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.
ModerateCVE-2015-0205SUSE bug 912293SUSE bug 915848SUSE bug 927623SUSE bug 937891cpe:/o:suse:suse-microos:5.0CVE-2015-0206SUSE Linux Enterprise Micro 5.0
Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection.
ModerateCVE-2015-0206SUSE bug 912292SUSE bug 927623SUSE bug 937891cpe:/o:suse:suse-microos:5.0CVE-2015-0209SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.
CriticalCVE-2015-0209SUSE bug 919648SUSE bug 936586SUSE bug 937891cpe:/o:suse:suse-microos:5.0CVE-2015-0236SUSE Linux Enterprise Micro 5.0
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.
LowCVE-2015-0236SUSE bug 914693cpe:/o:suse:suse-microos:5.0CVE-2015-0245SUSE Linux Enterprise Micro 5.0
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
LowCVE-2015-0245SUSE bug 1003898SUSE bug 916343cpe:/o:suse:suse-microos:5.0CVE-2015-0247SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.
ModerateCVE-2015-0247SUSE bug 1123790SUSE bug 915402SUSE bug 918346cpe:/o:suse:suse-microos:5.0CVE-2015-0274SUSE Linux Enterprise Micro 5.0
The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service (transaction overrun and data corruption) or possibly gain privileges by leveraging XFS filesystem access.
ImportantCVE-2015-0274SUSE bug 919655cpe:/o:suse:suse-microos:5.0CVE-2015-0275SUSE Linux Enterprise Micro 5.0
The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request.
ModerateCVE-2015-0275SUSE bug 919032cpe:/o:suse:suse-microos:5.0CVE-2015-0286SUSE Linux Enterprise Micro 5.0
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
CriticalCVE-2015-0286SUSE bug 919648SUSE bug 922496SUSE bug 936586SUSE bug 937891SUSE bug 951391cpe:/o:suse:suse-microos:5.0CVE-2015-0287SUSE Linux Enterprise Micro 5.0
The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.
CriticalCVE-2015-0287SUSE bug 919648SUSE bug 922499SUSE bug 936586SUSE bug 937891SUSE bug 968888SUSE bug 991722cpe:/o:suse:suse-microos:5.0CVE-2015-0288SUSE Linux Enterprise Micro 5.0
The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.
CriticalCVE-2015-0288SUSE bug 919648SUSE bug 920236SUSE bug 936586SUSE bug 937891SUSE bug 951391cpe:/o:suse:suse-microos:5.0CVE-2015-0289SUSE Linux Enterprise Micro 5.0
The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.
CriticalCVE-2015-0289SUSE bug 919648SUSE bug 922500SUSE bug 936586SUSE bug 937891cpe:/o:suse:suse-microos:5.0CVE-2015-0293SUSE Linux Enterprise Micro 5.0
The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.
CriticalCVE-2015-0293SUSE bug 919648SUSE bug 922488SUSE bug 936586SUSE bug 968044SUSE bug 968051SUSE bug 968053SUSE bug 986238cpe:/o:suse:suse-microos:5.0CVE-2015-0777SUSE Linux Enterprise Micro 5.0
drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors.
LowCVE-2015-0777SUSE bug 917830cpe:/o:suse:suse-microos:5.0CVE-2015-0837SUSE Linux Enterprise Micro 5.0
The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."
ModerateCVE-2015-0837SUSE bug 920057cpe:/o:suse:suse-microos:5.0CVE-2015-0840SUSE Linux Enterprise Micro 5.0
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
LowCVE-2015-0840SUSE bug 926749cpe:/o:suse:suse-microos:5.0CVE-2015-1283SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.
ModerateCVE-2015-1283SUSE bug 1034050SUSE bug 939077SUSE bug 979441SUSE bug 980391SUSE bug 983985cpe:/o:suse:suse-microos:5.0CVE-2015-1345SUSE Linux Enterprise Micro 5.0
The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.
LowCVE-2015-1345SUSE bug 914695cpe:/o:suse:suse-microos:5.0CVE-2015-1420SUSE Linux Enterprise Micro 5.0
Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function.
ModerateCVE-2015-1420SUSE bug 915517cpe:/o:suse:suse-microos:5.0CVE-2015-1472SUSE Linux Enterprise Micro 5.0
The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during memory allocation, which allows context-dependent attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long line containing wide characters that are improperly handled in a wscanf call.
ModerateCVE-2015-1472SUSE bug 916222SUSE bug 920341SUSE bug 922243cpe:/o:suse:suse-microos:5.0CVE-2015-1473SUSE Linux Enterprise Micro 5.0
The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.
ModerateCVE-2015-1473SUSE bug 916222SUSE bug 920341SUSE bug 922243cpe:/o:suse:suse-microos:5.0CVE-2015-1545SUSE Linux Enterprise Micro 5.0
The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.
ModerateCVE-2015-1545SUSE bug 846389SUSE bug 916897SUSE bug 916914cpe:/o:suse:suse-microos:5.0CVE-2015-1546SUSE Linux Enterprise Micro 5.0
Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.
ModerateCVE-2015-1546SUSE bug 916914cpe:/o:suse:suse-microos:5.0CVE-2015-1572SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.
LowCVE-2015-1572SUSE bug 1123790SUSE bug 915402SUSE bug 918346cpe:/o:suse:suse-microos:5.0CVE-2015-1593SUSE Linux Enterprise Micro 5.0
The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c.
ImportantCVE-2015-1593SUSE bug 1044934SUSE bug 917839cpe:/o:suse:suse-microos:5.0CVE-2015-1779SUSE Linux Enterprise Micro 5.0
The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.
ModerateCVE-2015-1779SUSE bug 924018SUSE bug 962632cpe:/o:suse:suse-microos:5.0CVE-2015-1781SUSE Linux Enterprise Micro 5.0
Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.
ModerateCVE-2015-1781SUSE bug 1123874SUSE bug 927080SUSE bug 979109cpe:/o:suse:suse-microos:5.0CVE-2015-1782SUSE Linux Enterprise Micro 5.0
The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.
ModerateCVE-2015-1782SUSE bug 921070cpe:/o:suse:suse-microos:5.0CVE-2015-1788SUSE Linux Enterprise Micro 5.0
The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allows remote attackers to cause a denial of service (infinite loop) via a session that uses an Elliptic Curve algorithm, as demonstrated by an attack against a server that supports client authentication.
ModerateCVE-2015-1788SUSE bug 934487SUSE bug 934666SUSE bug 936586SUSE bug 937891SUSE bug 938432cpe:/o:suse:suse-microos:5.0CVE-2015-1789SUSE Linux Enterprise Micro 5.0
The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.
ImportantCVE-2015-1789SUSE bug 934489SUSE bug 934666SUSE bug 936586SUSE bug 937891SUSE bug 938432SUSE bug 951391cpe:/o:suse:suse-microos:5.0CVE-2015-1790SUSE Linux Enterprise Micro 5.0
The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.
ModerateCVE-2015-1790SUSE bug 934491SUSE bug 934666SUSE bug 936586SUSE bug 938432cpe:/o:suse:suse-microos:5.0CVE-2015-1791SUSE Linux Enterprise Micro 5.0
Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.
ModerateCVE-2015-1791SUSE bug 933911SUSE bug 934666SUSE bug 986238SUSE bug 989464cpe:/o:suse:suse-microos:5.0CVE-2015-1792SUSE Linux Enterprise Micro 5.0
The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function.
ModerateCVE-2015-1792SUSE bug 934493SUSE bug 934666SUSE bug 937891SUSE bug 986238cpe:/o:suse:suse-microos:5.0CVE-2015-1793SUSE Linux Enterprise Micro 5.0
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
ModerateCVE-2015-1793SUSE bug 936746SUSE bug 937637SUSE bug 951391cpe:/o:suse:suse-microos:5.0CVE-2015-1794SUSE Linux Enterprise Micro 5.0
The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an anonymous Diffie-Hellman (DH) ServerKeyExchange message.
LowCVE-2015-1794SUSE bug 957984cpe:/o:suse:suse-microos:5.0CVE-2015-1805SUSE Linux Enterprise Micro 5.0
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun."
ImportantCVE-2015-1805SUSE bug 917839SUSE bug 933429SUSE bug 939270SUSE bug 964730SUSE bug 964732cpe:/o:suse:suse-microos:5.0CVE-2015-1819SUSE Linux Enterprise Micro 5.0
The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.
ModerateCVE-2015-1819SUSE bug 1123919SUSE bug 928193SUSE bug 969769cpe:/o:suse:suse-microos:5.0CVE-2015-1821SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the subnet remainder.
ModerateCVE-2015-1821SUSE bug 926323cpe:/o:suse:suse-microos:5.0CVE-2015-1822SUSE Linux Enterprise Micro 5.0
chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.
ModerateCVE-2015-1822SUSE bug 926323cpe:/o:suse:suse-microos:5.0CVE-2015-1853SUSE Linux Enterprise Micro 5.0
chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.
ModerateCVE-2015-1853SUSE bug 926323cpe:/o:suse:suse-microos:5.0CVE-2015-1863SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.
LowCVE-2015-1863SUSE bug 915323SUSE bug 927558cpe:/o:suse:suse-microos:5.0CVE-2015-2059SUSE Linux Enterprise Micro 5.0
The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read.
LowCVE-2015-2059SUSE bug 1173590SUSE bug 919214SUSE bug 923241SUSE bug 937096SUSE bug 937097cpe:/o:suse:suse-microos:5.0CVE-2015-2296SUSE Linux Enterprise Micro 5.0
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
LowCVE-2015-2296SUSE bug 922448SUSE bug 926396cpe:/o:suse:suse-microos:5.0CVE-2015-2325SUSE Linux Enterprise Micro 5.0
The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.
ModerateCVE-2015-2325SUSE bug 924960SUSE bug 933288SUSE bug 936408SUSE bug 958373cpe:/o:suse:suse-microos:5.0CVE-2015-2326SUSE Linux Enterprise Micro 5.0
The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".
ModerateCVE-2015-2326SUSE bug 924960SUSE bug 924961SUSE bug 933288SUSE bug 936408SUSE bug 958373cpe:/o:suse:suse-microos:5.0CVE-2015-2666SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.
ModerateCVE-2015-2666SUSE bug 922944SUSE bug 939044cpe:/o:suse:suse-microos:5.0CVE-2015-2694SUSE Linux Enterprise Micro 5.0
The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c.
ModerateCVE-2015-2694SUSE bug 928978cpe:/o:suse:suse-microos:5.0CVE-2015-2695SUSE Linux Enterprise Micro 5.0
lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.
ImportantCVE-2015-2695SUSE bug 770172SUSE bug 952188SUSE bug 969771cpe:/o:suse:suse-microos:5.0CVE-2015-2696SUSE Linux Enterprise Micro 5.0
lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.
ImportantCVE-2015-2696SUSE bug 770172SUSE bug 952189SUSE bug 954204cpe:/o:suse:suse-microos:5.0CVE-2015-2697SUSE Linux Enterprise Micro 5.0
The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.
ModerateCVE-2015-2697SUSE bug 770172SUSE bug 952190cpe:/o:suse:suse-microos:5.0CVE-2015-2698SUSE Linux Enterprise Micro 5.0
The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of service (memory corruption) or possibly have unspecified other impact by interacting with an application that calls the gss_export_sec_context function. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-2696.
ImportantCVE-2015-2698SUSE bug 770172SUSE bug 954204cpe:/o:suse:suse-microos:5.0CVE-2015-2721SUSE Linux Enterprise Micro 5.0
Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attackers to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue.
CriticalCVE-2015-2721SUSE bug 935979cpe:/o:suse:suse-microos:5.0CVE-2015-2806SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.
CriticalCVE-2015-2806SUSE bug 924828SUSE bug 929414SUSE bug 961491SUSE bug 969208cpe:/o:suse:suse-microos:5.0CVE-2015-2924SUSE Linux Enterprise Micro 5.0
The receive_ra function in rdisc/nm-lndp-rdisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in NetworkManager 1.x allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message, a similar issue to CVE-2015-2922.
ModerateCVE-2015-2924SUSE bug 926223cpe:/o:suse:suse-microos:5.0CVE-2015-3143SUSE Linux Enterprise Micro 5.0
cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.
ModerateCVE-2015-3143SUSE bug 927556cpe:/o:suse:suse-microos:5.0CVE-2015-3144SUSE Linux Enterprise Micro 5.0
The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
ImportantCVE-2015-3144SUSE bug 927608SUSE bug 951391cpe:/o:suse:suse-microos:5.0CVE-2015-3145SUSE Linux Enterprise Micro 5.0
The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.
ImportantCVE-2015-3145SUSE bug 927607cpe:/o:suse:suse-microos:5.0CVE-2015-3146SUSE Linux Enterprise Micro 5.0
The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.
ModerateCVE-2015-3146SUSE bug 928323cpe:/o:suse:suse-microos:5.0CVE-2015-3148SUSE Linux Enterprise Micro 5.0
cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.
ModerateCVE-2015-3148SUSE bug 1092962SUSE bug 927746cpe:/o:suse:suse-microos:5.0CVE-2015-3153SUSE Linux Enterprise Micro 5.0
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
ModerateCVE-2015-3153SUSE bug 928533SUSE bug 951391cpe:/o:suse:suse-microos:5.0CVE-2015-3193SUSE Linux Enterprise Micro 5.0
The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.
ModerateCVE-2015-3193SUSE bug 1022086SUSE bug 1066242SUSE bug 1071906SUSE bug 957814SUSE bug 960151SUSE bug 990370cpe:/o:suse:suse-microos:5.0CVE-2015-3194SUSE Linux Enterprise Micro 5.0
crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.
ModerateCVE-2015-3194SUSE bug 957812SUSE bug 957815SUSE bug 958768SUSE bug 976341SUSE bug 990370cpe:/o:suse:suse-microos:5.0CVE-2015-3195SUSE Linux Enterprise Micro 5.0
The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
ModerateCVE-2015-3195SUSE bug 923755SUSE bug 957812SUSE bug 957815SUSE bug 958768SUSE bug 963977SUSE bug 986238cpe:/o:suse:suse-microos:5.0CVE-2015-3196SUSE Linux Enterprise Micro 5.0
ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.
ModerateCVE-2015-3196SUSE bug 957813cpe:/o:suse:suse-microos:5.0CVE-2015-3197SUSE Linux Enterprise Micro 5.0
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.
LowCVE-2015-3197SUSE bug 963410SUSE bug 963415SUSE bug 968044SUSE bug 968046cpe:/o:suse:suse-microos:5.0CVE-2015-3202SUSE Linux Enterprise Micro 5.0
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
ModerateCVE-2015-3202SUSE bug 931452cpe:/o:suse:suse-microos:5.0CVE-2015-3209SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.
ImportantCVE-2015-3209SUSE bug 932267SUSE bug 932770SUSE bug 932823cpe:/o:suse:suse-microos:5.0CVE-2015-3217SUSE Linux Enterprise Micro 5.0
PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.
ModerateCVE-2015-3217SUSE bug 933878SUSE bug 958373cpe:/o:suse:suse-microos:5.0CVE-2015-3218SUSE Linux Enterprise Micro 5.0
The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.
ModerateCVE-2015-3218SUSE bug 933922SUSE bug 943816cpe:/o:suse:suse-microos:5.0CVE-2015-3236SUSE Linux Enterprise Micro 5.0
cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.
ModerateCVE-2015-3236SUSE bug 934501SUSE bug 951391cpe:/o:suse:suse-microos:5.0CVE-2015-3237SUSE Linux Enterprise Micro 5.0
The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
ModerateCVE-2015-3237SUSE bug 934502cpe:/o:suse:suse-microos:5.0CVE-2015-3238SUSE Linux Enterprise Micro 5.0
The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.
ModerateCVE-2015-3238SUSE bug 1123794SUSE bug 934920cpe:/o:suse:suse-microos:5.0CVE-2015-3239SUSE Linux Enterprise Micro 5.0
Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.
LowCVE-2015-3239SUSE bug 1122012SUSE bug 936786cpe:/o:suse:suse-microos:5.0CVE-2015-3247SUSE Linux Enterprise Micro 5.0
Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.
ModerateCVE-2015-3247SUSE bug 944460cpe:/o:suse:suse-microos:5.0CVE-2015-3255SUSE Linux Enterprise Micro 5.0
The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.
ModerateCVE-2015-3255SUSE bug 939246SUSE bug 943816cpe:/o:suse:suse-microos:5.0CVE-2015-3256SUSE Linux Enterprise Micro 5.0
PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation."
ModerateCVE-2015-3256SUSE bug 943816cpe:/o:suse:suse-microos:5.0CVE-2015-3259SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument.
ModerateCVE-2015-3259SUSE bug 935634SUSE bug 936281SUSE bug 937018SUSE bug 950367cpe:/o:suse:suse-microos:5.0CVE-2015-3288SUSE Linux Enterprise Micro 5.0
mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero.
ModerateCVE-2015-3288SUSE bug 1115893SUSE bug 979021cpe:/o:suse:suse-microos:5.0CVE-2015-3290SUSE Linux Enterprise Micro 5.0
arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.
ImportantCVE-2015-3290SUSE bug 937969SUSE bug 937970SUSE bug 938706SUSE bug 939207SUSE bug 939269cpe:/o:suse:suse-microos:5.0CVE-2015-3291SUSE Linux Enterprise Micro 5.0
arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly determine when nested NMI processing is occurring, which allows local users to cause a denial of service (skipped NMI) by modifying the rsp register, issuing a syscall instruction, and triggering an NMI.
LowCVE-2015-3291SUSE bug 937969SUSE bug 937970SUSE bug 938706cpe:/o:suse:suse-microos:5.0CVE-2015-3331SUSE Linux Enterprise Micro 5.0
The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket.
ModerateCVE-2015-3331SUSE bug 1115893SUSE bug 927257SUSE bug 931231SUSE bug 939262cpe:/o:suse:suse-microos:5.0CVE-2015-3340SUSE Linux Enterprise Micro 5.0
Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.
LowCVE-2015-3340SUSE bug 927967SUSE bug 929339cpe:/o:suse:suse-microos:5.0CVE-2015-3414SUSE Linux Enterprise Micro 5.0
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.
ModerateCVE-2015-3414SUSE bug 1085790SUSE bug 1190372SUSE bug 1193078SUSE bug 928700SUSE bug 928701SUSE bug 928702cpe:/o:suse:suse-microos:5.0CVE-2015-3415SUSE Linux Enterprise Micro 5.0
The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.
ModerateCVE-2015-3415SUSE bug 1190372SUSE bug 928700SUSE bug 928701SUSE bug 928702cpe:/o:suse:suse-microos:5.0CVE-2015-3416SUSE Linux Enterprise Micro 5.0
The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.
ModerateCVE-2015-3416SUSE bug 1190372SUSE bug 928700SUSE bug 928701SUSE bug 928702cpe:/o:suse:suse-microos:5.0CVE-2015-3456SUSE Linux Enterprise Micro 5.0
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
ModerateCVE-2015-3456SUSE bug 929339SUSE bug 932770SUSE bug 935900cpe:/o:suse:suse-microos:5.0CVE-2015-3622SUSE Linux Enterprise Micro 5.0
The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.
LowCVE-2015-3622SUSE bug 929414cpe:/o:suse:suse-microos:5.0CVE-2015-3627SUSE Linux Enterprise Micro 5.0
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
LowCVE-2015-3627SUSE bug 930235SUSE bug 945060cpe:/o:suse:suse-microos:5.0CVE-2015-3629SUSE Linux Enterprise Micro 5.0
Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
ImportantCVE-2015-3629SUSE bug 930235SUSE bug 945060cpe:/o:suse:suse-microos:5.0CVE-2015-3630SUSE Linux Enterprise Micro 5.0
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
ImportantCVE-2015-3630SUSE bug 930235SUSE bug 945060cpe:/o:suse:suse-microos:5.0CVE-2015-3631SUSE Linux Enterprise Micro 5.0
Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
LowCVE-2015-3631SUSE bug 930235SUSE bug 945060cpe:/o:suse:suse-microos:5.0CVE-2015-3636SUSE Linux Enterprise Micro 5.0
The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.
ModerateCVE-2015-3636SUSE bug 929525SUSE bug 939277SUSE bug 994624cpe:/o:suse:suse-microos:5.0CVE-2015-4000SUSE Linux Enterprise Micro 5.0
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
ImportantCVE-2015-4000SUSE bug 1074631SUSE bug 1211968SUSE bug 931600SUSE bug 931698SUSE bug 931723SUSE bug 931845SUSE bug 932026SUSE bug 932483SUSE bug 934789SUSE bug 935033SUSE bug 935540SUSE bug 935979SUSE bug 937202SUSE bug 937766SUSE bug 938248SUSE bug 938432SUSE bug 938895SUSE bug 938905SUSE bug 938906SUSE bug 938913SUSE bug 938945SUSE bug 943664SUSE bug 944729SUSE bug 945582SUSE bug 955589SUSE bug 980406SUSE bug 990592SUSE bug 994144cpe:/o:suse:suse-microos:5.0CVE-2015-4037SUSE Linux Enterprise Micro 5.0
The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program.
LowCVE-2015-4037SUSE bug 932267SUSE bug 950367cpe:/o:suse:suse-microos:5.0CVE-2015-4041SUSE Linux Enterprise Micro 5.0
The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.
CriticalCVE-2015-4041SUSE bug 928749cpe:/o:suse:suse-microos:5.0CVE-2015-4042SUSE Linux Enterprise Micro 5.0
Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings.
CriticalCVE-2015-4042SUSE bug 1167100SUSE bug 928749cpe:/o:suse:suse-microos:5.0CVE-2015-4103SUSE Linux Enterprise Micro 5.0
Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.
ModerateCVE-2015-4103SUSE bug 931625cpe:/o:suse:suse-microos:5.0CVE-2015-4104SUSE Linux Enterprise Micro 5.0
Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.
ImportantCVE-2015-4104SUSE bug 931626cpe:/o:suse:suse-microos:5.0CVE-2015-4105SUSE Linux Enterprise Micro 5.0
Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk consumption) via certain invalid operations.
ModerateCVE-2015-4105SUSE bug 931627cpe:/o:suse:suse-microos:5.0CVE-2015-4106SUSE Linux Enterprise Micro 5.0
QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors.
ModerateCVE-2015-4106SUSE bug 931628cpe:/o:suse:suse-microos:5.0CVE-2015-4141SUSE Linux Enterprise Micro 5.0
The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow.
ModerateCVE-2015-4141SUSE bug 915323SUSE bug 930077cpe:/o:suse:suse-microos:5.0CVE-2015-4142SUSE Linux Enterprise Micro 5.0
Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.
ModerateCVE-2015-4142SUSE bug 915323SUSE bug 930078cpe:/o:suse:suse-microos:5.0CVE-2015-4143SUSE Linux Enterprise Micro 5.0
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.
ModerateCVE-2015-4143SUSE bug 930079cpe:/o:suse:suse-microos:5.0CVE-2015-4144SUSE Linux Enterprise Micro 5.0
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.
ModerateCVE-2015-4144SUSE bug 930079cpe:/o:suse:suse-microos:5.0CVE-2015-4145SUSE Linux Enterprise Micro 5.0
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.
ModerateCVE-2015-4145SUSE bug 930079cpe:/o:suse:suse-microos:5.0CVE-2015-4146SUSE Linux Enterprise Micro 5.0
The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message.
ModerateCVE-2015-4146SUSE bug 930079cpe:/o:suse:suse-microos:5.0CVE-2015-4167SUSE Linux Enterprise Micro 5.0
The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain length values, which allows local users to cause a denial of service (incorrect data representation or integer overflow, and OOPS) via a crafted UDF filesystem.
ImportantCVE-2015-4167SUSE bug 917839SUSE bug 933907cpe:/o:suse:suse-microos:5.0CVE-2015-4625SUSE Linux Enterprise Micro 5.0
Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.
ModerateCVE-2015-4625SUSE bug 935119SUSE bug 943816cpe:/o:suse:suse-microos:5.0CVE-2015-4692SUSE Linux Enterprise Micro 5.0
The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.
ImportantCVE-2015-4692SUSE bug 935542cpe:/o:suse:suse-microos:5.0CVE-2015-5154SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
ImportantCVE-2015-5154SUSE bug 938344SUSE bug 950367cpe:/o:suse:suse-microos:5.0CVE-2015-5156SUSE Linux Enterprise Micro 5.0
The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.
ModerateCVE-2015-5156SUSE bug 1091815SUSE bug 1123903SUSE bug 940776SUSE bug 945048SUSE bug 951638cpe:/o:suse:suse-microos:5.0CVE-2015-5157SUSE Linux Enterprise Micro 5.0
arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI.
ImportantCVE-2015-5157SUSE bug 1072204SUSE bug 1115893SUSE bug 937969SUSE bug 937970SUSE bug 938706SUSE bug 939207cpe:/o:suse:suse-microos:5.0CVE-2015-5165SUSE Linux Enterprise Micro 5.0
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
ModerateCVE-2015-5165SUSE bug 939712SUSE bug 950367cpe:/o:suse:suse-microos:5.0CVE-2015-5180SUSE Linux Enterprise Micro 5.0
res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash).
ImportantCVE-2015-5180SUSE bug 1123874SUSE bug 1215582SUSE bug 941234cpe:/o:suse:suse-microos:5.0CVE-2015-5186SUSE Linux Enterprise Micro 5.0
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
ModerateCVE-2015-5186SUSE bug 941922cpe:/o:suse:suse-microos:5.0CVE-2015-5191SUSE Linux Enterprise Micro 5.0
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
ModerateCVE-2015-5191SUSE bug 1007600cpe:/o:suse:suse-microos:5.0CVE-2015-5218SUSE Linux Enterprise Micro 5.0
Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.
LowCVE-2015-5218SUSE bug 949754cpe:/o:suse:suse-microos:5.0CVE-2015-5225SUSE Linux Enterprise Micro 5.0
Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.
ModerateCVE-2015-5225SUSE bug 942845cpe:/o:suse:suse-microos:5.0CVE-2015-5239SUSE Linux Enterprise Micro 5.0
Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
ModerateCVE-2015-5239SUSE bug 944463SUSE bug 950367cpe:/o:suse:suse-microos:5.0CVE-2015-5245SUSE Linux Enterprise Micro 5.0
CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
ModerateCVE-2015-5245SUSE bug 945206cpe:/o:suse:suse-microos:5.0CVE-2015-5247SUSE Linux Enterprise Micro 5.0
The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.
LowCVE-2015-5247SUSE bug 945645cpe:/o:suse:suse-microos:5.0CVE-2015-5260SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter.
ImportantCVE-2015-5260SUSE bug 944787cpe:/o:suse:suse-microos:5.0CVE-2015-5261SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
ImportantCVE-2015-5261SUSE bug 948976SUSE bug 982386cpe:/o:suse:suse-microos:5.0CVE-2015-5278SUSE Linux Enterprise Micro 5.0
The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
ModerateCVE-2015-5278SUSE bug 945989SUSE bug 964947cpe:/o:suse:suse-microos:5.0CVE-2015-5279SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
ImportantCVE-2015-5279SUSE bug 945987cpe:/o:suse:suse-microos:5.0CVE-2015-5297SUSE Linux Enterprise Micro 5.0
An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.
ModerateCVE-2015-5297SUSE bug 1117000cpe:/o:suse:suse-microos:5.0CVE-2015-5307SUSE Linux Enterprise Micro 5.0
The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.
ModerateCVE-2015-5307SUSE bug 953527SUSE bug 954018SUSE bug 954404SUSE bug 954405SUSE bug 962977cpe:/o:suse:suse-microos:5.0CVE-2015-5310SUSE Linux Enterprise Micro 5.0
The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.
LowCVE-2015-5310SUSE bug 952254SUSE bug 953115cpe:/o:suse:suse-microos:5.0CVE-2015-5312SUSE Linux Enterprise Micro 5.0
The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
ImportantCVE-2015-5312SUSE bug 1123919SUSE bug 957105SUSE bug 959469SUSE bug 969769cpe:/o:suse:suse-microos:5.0CVE-2015-5313SUSE Linux Enterprise Micro 5.0
Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.
LowCVE-2015-5313SUSE bug 953110cpe:/o:suse:suse-microos:5.0CVE-2015-5315SUSE Linux Enterprise Micro 5.0
The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when EAP-pwd is enabled in a network configuration profile, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.
ModerateCVE-2015-5315SUSE bug 953115cpe:/o:suse:suse-microos:5.0CVE-2015-5316SUSE Linux Enterprise Micro 5.0
The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network configuration profile, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an EAP-pwd Confirm message followed by the Identity exchange.
ModerateCVE-2015-5316SUSE bug 953115cpe:/o:suse:suse-microos:5.0CVE-2015-5738SUSE Linux Enterprise Micro 5.0
The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack.
ImportantCVE-2015-5738SUSE bug 944456SUSE bug 944835SUSE bug 944836cpe:/o:suse:suse-microos:5.0CVE-2015-5745SUSE Linux Enterprise Micro 5.0
Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
LowCVE-2015-5745SUSE bug 940929SUSE bug 950367cpe:/o:suse:suse-microos:5.0CVE-2015-6251SUSE Linux Enterprise Micro 5.0
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
ModerateCVE-2015-6251SUSE bug 941794cpe:/o:suse:suse-microos:5.0CVE-2015-6525SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_prepend, (3) evbuffer_expand, (4) exbuffer_reserve_space, or (5) evbuffer_read function, which triggers a heap-based buffer overflow or an infinite loop. NOTE: this identifier was SPLIT from CVE-2014-6272 per ADT3 due to different affected versions.
LowCVE-2015-6525SUSE bug 897243SUSE bug 943011cpe:/o:suse:suse-microos:5.0CVE-2015-6815SUSE Linux Enterprise Micro 5.0
The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.
LowCVE-2015-6815SUSE bug 944697SUSE bug 950367cpe:/o:suse:suse-microos:5.0CVE-2015-6855SUSE Linux Enterprise Micro 5.0
hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.
ModerateCVE-2015-6855SUSE bug 945404SUSE bug 965156cpe:/o:suse:suse-microos:5.0CVE-2015-6908SUSE Linux Enterprise Micro 5.0
The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.
ImportantCVE-2015-6908SUSE bug 945582cpe:/o:suse:suse-microos:5.0CVE-2015-6937SUSE Linux Enterprise Micro 5.0
The __rds_conn_create function in net/rds/connection.c in the Linux kernel through 4.2.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound.
ModerateCVE-2015-6937SUSE bug 1115893SUSE bug 923755SUSE bug 945825SUSE bug 952384SUSE bug 953052SUSE bug 963994cpe:/o:suse:suse-microos:5.0CVE-2015-7181SUSE Linux Enterprise Micro 5.0
The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data, related to a "use-after-poison" issue.
ImportantCVE-2015-7181SUSE bug 952810cpe:/o:suse:suse-microos:5.0CVE-2015-7182SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
ImportantCVE-2015-7182SUSE bug 952810cpe:/o:suse:suse-microos:5.0CVE-2015-7183SUSE Linux Enterprise Micro 5.0
Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
ImportantCVE-2015-7183SUSE bug 952810SUSE bug 962977cpe:/o:suse:suse-microos:5.0CVE-2015-7236SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.
ModerateCVE-2015-7236SUSE bug 940191SUSE bug 946204SUSE bug 979097cpe:/o:suse:suse-microos:5.0CVE-2015-7295SUSE Linux Enterprise Micro 5.0
hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface.
ModerateCVE-2015-7295SUSE bug 947159SUSE bug 950367cpe:/o:suse:suse-microos:5.0CVE-2015-7311SUSE Linux Enterprise Micro 5.0
libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.
LowCVE-2015-7311SUSE bug 947165SUSE bug 950367cpe:/o:suse:suse-microos:5.0CVE-2015-7497SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors.
ModerateCVE-2015-7497SUSE bug 1123919SUSE bug 957106SUSE bug 959469SUSE bug 969769cpe:/o:suse:suse-microos:5.0CVE-2015-7498SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure.
ModerateCVE-2015-7498SUSE bug 1123919SUSE bug 957107SUSE bug 959469SUSE bug 969769cpe:/o:suse:suse-microos:5.0CVE-2015-7499SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.
ModerateCVE-2015-7499SUSE bug 1123919SUSE bug 957109SUSE bug 959469SUSE bug 969769cpe:/o:suse:suse-microos:5.0CVE-2015-7500SUSE Linux Enterprise Micro 5.0
The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags.
ModerateCVE-2015-7500SUSE bug 1123919SUSE bug 957110SUSE bug 959469SUSE bug 969769cpe:/o:suse:suse-microos:5.0CVE-2015-7504SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.
ImportantCVE-2015-7504SUSE bug 956411cpe:/o:suse:suse-microos:5.0CVE-2015-7510SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
ImportantCVE-2015-7510SUSE bug 956712cpe:/o:suse:suse-microos:5.0CVE-2015-7511SUSE Linux Enterprise Micro 5.0
Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.
ModerateCVE-2015-7511SUSE bug 965902cpe:/o:suse:suse-microos:5.0CVE-2015-7512SUSE Linux Enterprise Micro 5.0
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.
ImportantCVE-2015-7512SUSE bug 957162SUSE bug 962360cpe:/o:suse:suse-microos:5.0CVE-2015-7513SUSE Linux Enterprise Micro 5.0
arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions.
ModerateCVE-2015-7513SUSE bug 1020452SUSE bug 960689SUSE bug 987709cpe:/o:suse:suse-microos:5.0CVE-2015-7547SUSE Linux Enterprise Micro 5.0
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
ImportantCVE-2015-7547SUSE bug 1077097SUSE bug 847227SUSE bug 961721SUSE bug 967023SUSE bug 967061SUSE bug 967072SUSE bug 967496SUSE bug 969216SUSE bug 969241SUSE bug 969591SUSE bug 986086cpe:/o:suse:suse-microos:5.0CVE-2015-7549SUSE Linux Enterprise Micro 5.0
The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.
LowCVE-2015-7549SUSE bug 958917SUSE bug 958918cpe:/o:suse:suse-microos:5.0CVE-2015-7566SUSE Linux Enterprise Micro 5.0
The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a bulk-out endpoint.
LowCVE-2015-7566SUSE bug 1020452SUSE bug 961512cpe:/o:suse:suse-microos:5.0CVE-2015-7575SUSE Linux Enterprise Micro 5.0
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
ModerateCVE-2015-7575SUSE bug 959888SUSE bug 960402SUSE bug 960996SUSE bug 961280SUSE bug 961281SUSE bug 961282SUSE bug 961283SUSE bug 961284SUSE bug 961290SUSE bug 961357SUSE bug 962743SUSE bug 963937SUSE bug 967521SUSE bug 981087cpe:/o:suse:suse-microos:5.0CVE-2015-7613SUSE Linux Enterprise Micro 5.0
Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c.
ModerateCVE-2015-7613SUSE bug 923755SUSE bug 948536SUSE bug 948701SUSE bug 963994cpe:/o:suse:suse-microos:5.0CVE-2015-7799SUSE Linux Enterprise Micro 5.0
The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel through 4.2.3 does not ensure that certain slot numbers are valid, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call.
LowCVE-2015-7799SUSE bug 1020452SUSE bug 1052256SUSE bug 949936SUSE bug 951638cpe:/o:suse:suse-microos:5.0CVE-2015-7833SUSE Linux Enterprise Micro 5.0
The usbvision driver in the Linux kernel package 3.10.0-123.20.1.el7 through 3.10.0-229.14.1.el7 in Red Hat Enterprise Linux (RHEL) 7.1 allows physically proximate attackers to cause a denial of service (panic) via a nonzero bInterfaceNumber value in a USB device descriptor.
ModerateCVE-2015-7833SUSE bug 1020452SUSE bug 950998cpe:/o:suse:suse-microos:5.0CVE-2015-7835SUSE Linux Enterprise Micro 5.0
The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.
ImportantCVE-2015-7835SUSE bug 940929SUSE bug 947159SUSE bug 950367cpe:/o:suse:suse-microos:5.0CVE-2015-7884SUSE Linux Enterprise Micro 5.0
The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.
LowCVE-2015-7884SUSE bug 1126909SUSE bug 951626SUSE bug 951627cpe:/o:suse:suse-microos:5.0CVE-2015-7885SUSE Linux Enterprise Micro 5.0
The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.
LowCVE-2015-7885SUSE bug 1126909SUSE bug 951626SUSE bug 951627cpe:/o:suse:suse-microos:5.0CVE-2015-7941SUSE Linux Enterprise Micro 5.0
libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.
LowCVE-2015-7941SUSE bug 1123919SUSE bug 951734SUSE bug 951735SUSE bug 969769cpe:/o:suse:suse-microos:5.0CVE-2015-7942SUSE Linux Enterprise Micro 5.0
The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.
LowCVE-2015-7942SUSE bug 1123919SUSE bug 951735SUSE bug 969769cpe:/o:suse:suse-microos:5.0CVE-2015-7969SUSE Linux Enterprise Micro 5.0
Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall.
ModerateCVE-2015-7969SUSE bug 950703SUSE bug 950705cpe:/o:suse:suse-microos:5.0CVE-2015-7970SUSE Linux Enterprise Micro 5.0
The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrators to cause a denial of service (CPU consumption and possibly reboot) via crafted memory contents that triggers a "time-consuming linear scan," related to Populate-on-Demand.
ModerateCVE-2015-7970SUSE bug 950704cpe:/o:suse:suse-microos:5.0CVE-2015-7971SUSE Linux Enterprise Micro 5.0
Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.
LowCVE-2015-7971SUSE bug 950706cpe:/o:suse:suse-microos:5.0CVE-2015-7972SUSE Linux Enterprise Micro 5.0
The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not properly calculate the balloon size when using the populate-on-demand (PoD) system, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors related to "heavy memory pressure."
LowCVE-2015-7972SUSE bug 950704SUSE bug 951845cpe:/o:suse:suse-microos:5.0CVE-2015-7990SUSE Linux Enterprise Micro 5.0
Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937.
LowCVE-2015-7990SUSE bug 945825SUSE bug 952384SUSE bug 953052cpe:/o:suse:suse-microos:5.0CVE-2015-7995SUSE Linux Enterprise Micro 5.0
The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a "type confusion" issue.
LowCVE-2015-7995SUSE bug 1123130SUSE bug 952474cpe:/o:suse:suse-microos:5.0CVE-2015-8019SUSE Linux Enterprise Micro 5.0
The skb_copy_and_csum_datagram_iovec function in net/core/datagram.c in the Linux kernel 3.14.54 and 3.18.22 does not accept a length argument, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a write system call followed by a recvmsg system call.
ModerateCVE-2015-8019SUSE bug 1032268SUSE bug 951199SUSE bug 952587SUSE bug 979078cpe:/o:suse:suse-microos:5.0CVE-2015-8035SUSE Linux Enterprise Micro 5.0
The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
LowCVE-2015-8035SUSE bug 1088279SUSE bug 1105166SUSE bug 954429cpe:/o:suse:suse-microos:5.0CVE-2015-8041SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record, which triggers an out-of-bounds read.
ModerateCVE-2015-8041SUSE bug 937419cpe:/o:suse:suse-microos:5.0CVE-2015-8104SUSE Linux Enterprise Micro 5.0
The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.
ModerateCVE-2015-8104SUSE bug 1215748SUSE bug 953527SUSE bug 954018SUSE bug 954404SUSE bug 954405SUSE bug 962977cpe:/o:suse:suse-microos:5.0CVE-2015-8126SUSE Linux Enterprise Micro 5.0
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
ModerateCVE-2015-8126SUSE bug 954980SUSE bug 958198SUSE bug 960402SUSE bug 962743SUSE bug 963937SUSE bug 969333cpe:/o:suse:suse-microos:5.0CVE-2015-8242SUSE Linux Enterprise Micro 5.0
The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
ModerateCVE-2015-8242SUSE bug 1123919SUSE bug 956021SUSE bug 959469SUSE bug 969769cpe:/o:suse:suse-microos:5.0CVE-2015-8324SUSE Linux Enterprise Micro 5.0
The ext4 implementation in the Linux kernel before 2.6.34 does not properly track the initialization of certain data structures, which allows physically proximate attackers to cause a denial of service (NULL pointer dereference and panic) via a crafted USB device, related to the ext4_fill_super function.
ModerateCVE-2015-8324SUSE bug 956707cpe:/o:suse:suse-microos:5.0CVE-2015-8325SUSE Linux Enterprise Micro 5.0
The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
ModerateCVE-2015-8325SUSE bug 1138392SUSE bug 975865SUSE bug 996040cpe:/o:suse:suse-microos:5.0CVE-2015-8339SUSE Linux Enterprise Micro 5.0
The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.
ModerateCVE-2015-8339SUSE bug 956408cpe:/o:suse:suse-microos:5.0CVE-2015-8340SUSE Linux Enterprise Micro 5.0
The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling.
ModerateCVE-2015-8340SUSE bug 956408cpe:/o:suse:suse-microos:5.0CVE-2015-8341SUSE Linux Enterprise Micro 5.0
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
ModerateCVE-2015-8341SUSE bug 956409cpe:/o:suse:suse-microos:5.0CVE-2015-8345SUSE Linux Enterprise Micro 5.0
The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.
ModerateCVE-2015-8345SUSE bug 956829SUSE bug 956832cpe:/o:suse:suse-microos:5.0CVE-2015-8370SUSE Linux Enterprise Micro 5.0
Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.
ModerateCVE-2015-8370SUSE bug 956631cpe:/o:suse:suse-microos:5.0CVE-2015-8374SUSE Linux Enterprise Micro 5.0
fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local users to obtain sensitive pre-truncation information from a file via a clone action.
LowCVE-2015-8374SUSE bug 923755SUSE bug 956053SUSE bug 963994cpe:/o:suse:suse-microos:5.0CVE-2015-8504SUSE Linux Enterprise Micro 5.0
Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.
ModerateCVE-2015-8504SUSE bug 958491SUSE bug 958493cpe:/o:suse:suse-microos:5.0CVE-2015-8539SUSE Linux Enterprise Micro 5.0
The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c.
ImportantCVE-2015-8539SUSE bug 1115893SUSE bug 781018SUSE bug 958463SUSE bug 958601cpe:/o:suse:suse-microos:5.0CVE-2015-8543SUSE Linux Enterprise Micro 5.0
The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application.
ModerateCVE-2015-8543SUSE bug 1020452SUSE bug 1052256SUSE bug 1115893SUSE bug 923755SUSE bug 958886SUSE bug 963994SUSE bug 969522cpe:/o:suse:suse-microos:5.0CVE-2015-8550SUSE Linux Enterprise Micro 5.0
Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability.
ModerateCVE-2015-8550SUSE bug 1020452SUSE bug 1052256SUSE bug 957988cpe:/o:suse:suse-microos:5.0CVE-2015-8551SUSE Linux Enterprise Micro 5.0
The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka "Linux pciback missing sanity checks."
ModerateCVE-2015-8551SUSE bug 1020452SUSE bug 957990cpe:/o:suse:suse-microos:5.0CVE-2015-8552SUSE Linux Enterprise Micro 5.0
The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks."
ModerateCVE-2015-8552SUSE bug 1020452SUSE bug 957990cpe:/o:suse:suse-microos:5.0CVE-2015-8553SUSE Linux Enterprise Micro 5.0
Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777.
ModerateCVE-2015-8553SUSE bug 903967SUSE bug 957990cpe:/o:suse:suse-microos:5.0CVE-2015-8554SUSE Linux Enterprise Micro 5.0
Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path."
ModerateCVE-2015-8554SUSE bug 958007cpe:/o:suse:suse-microos:5.0CVE-2015-8555SUSE Linux Enterprise Micro 5.0
Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.
ModerateCVE-2015-8555SUSE bug 958009cpe:/o:suse:suse-microos:5.0CVE-2015-8558SUSE Linux Enterprise Micro 5.0
The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.
ModerateCVE-2015-8558SUSE bug 959005SUSE bug 959006SUSE bug 976109SUSE bug 976111cpe:/o:suse:suse-microos:5.0CVE-2015-8567SUSE Linux Enterprise Micro 5.0
Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).
LowCVE-2015-8567SUSE bug 959386SUSE bug 959387cpe:/o:suse:suse-microos:5.0CVE-2015-8568SUSE Linux Enterprise Micro 5.0
Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly.
LowCVE-2015-8568SUSE bug 959386SUSE bug 959387cpe:/o:suse:suse-microos:5.0CVE-2015-8613SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.
ModerateCVE-2015-8613SUSE bug 961358SUSE bug 961556cpe:/o:suse:suse-microos:5.0CVE-2015-8615SUSE Linux Enterprise Micro 5.0
The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
LowCVE-2015-8615SUSE bug 960093cpe:/o:suse:suse-microos:5.0CVE-2015-8619SUSE Linux Enterprise Micro 5.0
The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash).
ModerateCVE-2015-8619SUSE bug 960334SUSE bug 965269cpe:/o:suse:suse-microos:5.0CVE-2015-8629SUSE Linux Enterprise Micro 5.0
The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.
LowCVE-2015-8629SUSE bug 770172SUSE bug 963968cpe:/o:suse:suse-microos:5.0CVE-2015-8630SUSE Linux Enterprise Micro 5.0
The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name.
LowCVE-2015-8630SUSE bug 963964cpe:/o:suse:suse-microos:5.0CVE-2015-8631SUSE Linux Enterprise Micro 5.0
Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.
ModerateCVE-2015-8631SUSE bug 963975cpe:/o:suse:suse-microos:5.0CVE-2015-8660SUSE Linux Enterprise Micro 5.0
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
ImportantCVE-2015-8660SUSE bug 923755SUSE bug 960281SUSE bug 960329SUSE bug 963994cpe:/o:suse:suse-microos:5.0CVE-2015-8743SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes.
ModerateCVE-2015-8743SUSE bug 960725SUSE bug 960726cpe:/o:suse:suse-microos:5.0CVE-2015-8744SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.
LowCVE-2015-8744SUSE bug 960835SUSE bug 960836cpe:/o:suse:suse-microos:5.0CVE-2015-8745SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.
LowCVE-2015-8745SUSE bug 960707SUSE bug 960708cpe:/o:suse:suse-microos:5.0CVE-2015-8776SUSE Linux Enterprise Micro 5.0
The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value.
LowCVE-2015-8776SUSE bug 1123874SUSE bug 962736SUSE bug 986086cpe:/o:suse:suse-microos:5.0CVE-2015-8777SUSE Linux Enterprise Micro 5.0
The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable.
LowCVE-2015-8777SUSE bug 1123874SUSE bug 950944SUSE bug 962735cpe:/o:suse:suse-microos:5.0CVE-2015-8778SUSE Linux Enterprise Micro 5.0
Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access.
LowCVE-2015-8778SUSE bug 1123874SUSE bug 962737SUSE bug 986086cpe:/o:suse:suse-microos:5.0CVE-2015-8779SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.
ImportantCVE-2015-8779SUSE bug 1123874SUSE bug 962739SUSE bug 965453SUSE bug 986086cpe:/o:suse:suse-microos:5.0CVE-2015-8785SUSE Linux Enterprise Micro 5.0
The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov.
LowCVE-2015-8785SUSE bug 1020452SUSE bug 963765cpe:/o:suse:suse-microos:5.0CVE-2015-8803SUSE Linux Enterprise Micro 5.0
The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.
ModerateCVE-2015-8803SUSE bug 964845cpe:/o:suse:suse-microos:5.0CVE-2015-8804SUSE Linux Enterprise Micro 5.0
x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors.
ModerateCVE-2015-8804SUSE bug 964847cpe:/o:suse:suse-microos:5.0CVE-2015-8805SUSE Linux Enterprise Micro 5.0
The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803.
ModerateCVE-2015-8805SUSE bug 964849cpe:/o:suse:suse-microos:5.0CVE-2015-8816SUSE Linux Enterprise Micro 5.0
The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device.
ModerateCVE-2015-8816SUSE bug 1020452SUSE bug 968010SUSE bug 979064cpe:/o:suse:suse-microos:5.0CVE-2015-8830SUSE Linux Enterprise Micro 5.0
Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE: this vulnerability exists because of a CVE-2012-6701 regression.
ImportantCVE-2015-8830SUSE bug 969354SUSE bug 969355cpe:/o:suse:suse-microos:5.0CVE-2015-8839SUSE Linux Enterprise Micro 5.0
Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling.
ModerateCVE-2015-8839SUSE bug 972174cpe:/o:suse:suse-microos:5.0CVE-2015-8844SUSE Linux Enterprise Micro 5.0
The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.
ModerateCVE-2015-8844SUSE bug 975531SUSE bug 975533cpe:/o:suse:suse-microos:5.0CVE-2015-8845SUSE Linux Enterprise Micro 5.0
The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.
ModerateCVE-2015-8845SUSE bug 975531SUSE bug 975533cpe:/o:suse:suse-microos:5.0CVE-2015-8948SUSE Linux Enterprise Micro 5.0
idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.
ModerateCVE-2015-8948SUSE bug 1014473SUSE bug 1173590SUSE bug 1190777SUSE bug 990189cpe:/o:suse:suse-microos:5.0CVE-2015-8950SUSE Linux Enterprise Micro 5.0
arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by triggering a dma_mmap call.
LowCVE-2015-8950SUSE bug 1003931SUSE bug 1004045cpe:/o:suse:suse-microos:5.0CVE-2015-8952SUSE Linux Enterprise Micro 5.0
The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux kernel before 4.6 mishandles xattr block caching, which allows local users to cause a denial of service (soft lockup) via filesystem operations in environments that use many attributes, as demonstrated by Ceph and Samba.
ModerateCVE-2015-8952SUSE bug 995759cpe:/o:suse:suse-microos:5.0CVE-2015-8953SUSE Linux Enterprise Micro 5.0
fs/overlayfs/copy_up.c in the Linux kernel before 4.2.6 uses an incorrect cleanup code path, which allows local users to cause a denial of service (dentry reference leak) via filesystem operations on a large file in a lower overlayfs layer.
LowCVE-2015-8953SUSE bug 995763cpe:/o:suse:suse-microos:5.0CVE-2015-8955SUSE Linux Enterprise Micro 5.0
arch/arm64/kernel/perf_event.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via vectors involving events that are mishandled during a span of multiple HW PMUs.
ImportantCVE-2015-8955SUSE bug 1003931cpe:/o:suse:suse-microos:5.0CVE-2015-8962SUSE Linux Enterprise Micro 5.0
Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.
ModerateCVE-2015-8962SUSE bug 1010501SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2015-8963SUSE Linux Enterprise Micro 5.0
Race condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation.
ModerateCVE-2015-8963SUSE bug 1010502cpe:/o:suse:suse-microos:5.0CVE-2015-8970SUSE Linux Enterprise Micro 5.0
crypto/algif_skcipher.c in the Linux kernel before 4.4.2 does not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c.
ModerateCVE-2015-8970SUSE bug 1008374SUSE bug 1008850cpe:/o:suse:suse-microos:5.0CVE-2015-8982SUSE Linux Enterprise Micro 5.0
Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.
ImportantCVE-2015-8982SUSE bug 1123874SUSE bug 1193616SUSE bug 1199869SUSE bug 1200203SUSE bug 920169SUSE bug 920338cpe:/o:suse:suse-microos:5.0CVE-2015-8983SUSE Linux Enterprise Micro 5.0
Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.
ModerateCVE-2015-8983SUSE bug 1123874SUSE bug 1193615SUSE bug 1199869SUSE bug 920169SUSE bug 920338cpe:/o:suse:suse-microos:5.0CVE-2015-8985SUSE Linux Enterprise Micro 5.0
The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.
ModerateCVE-2015-8985SUSE bug 1193625SUSE bug 920169SUSE bug 920338cpe:/o:suse:suse-microos:5.0CVE-2015-9019SUSE Linux Enterprise Micro 5.0
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.
LowCVE-2015-9019SUSE bug 1123130SUSE bug 934119cpe:/o:suse:suse-microos:5.0CVE-2015-9251SUSE Linux Enterprise Micro 5.0
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
CriticalCVE-2015-9251SUSE bug 1099458SUSE bug 1100133SUSE bug 1111660cpe:/o:suse:suse-microos:5.0CVE-2015-9289SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.
CriticalCVE-2015-9289SUSE bug 1143179cpe:/o:suse:suse-microos:5.0CVE-2015-9290SUSE Linux Enterprise Micro 5.0
In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again.
LowCVE-2015-9290SUSE bug 1143564cpe:/o:suse:suse-microos:5.0CVE-2015-9381SUSE Linux Enterprise Micro 5.0
FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.
ModerateCVE-2015-9381SUSE bug 1149384cpe:/o:suse:suse-microos:5.0CVE-2015-9382SUSE Linux Enterprise Micro 5.0
FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation.
ModerateCVE-2015-9382SUSE bug 1149395cpe:/o:suse:suse-microos:5.0CVE-2015-9383SUSE Linux Enterprise Micro 5.0
FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.
ModerateCVE-2015-9383SUSE bug 1149397cpe:/o:suse:suse-microos:5.0CVE-2016-0701SUSE Linux Enterprise Micro 5.0
The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.
ImportantCVE-2016-0701SUSE bug 1071906SUSE bug 1176331SUSE bug 1195379SUSE bug 963410SUSE bug 963413cpe:/o:suse:suse-microos:5.0CVE-2016-0702SUSE Linux Enterprise Micro 5.0
The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.
ImportantCVE-2016-0702SUSE bug 1007806SUSE bug 968044SUSE bug 968050SUSE bug 971238SUSE bug 990370cpe:/o:suse:suse-microos:5.0CVE-2016-0705SUSE Linux Enterprise Micro 5.0
Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.
CriticalCVE-2016-0705SUSE bug 968044SUSE bug 968047SUSE bug 971238SUSE bug 976341cpe:/o:suse:suse-microos:5.0CVE-2016-0718SUSE Linux Enterprise Micro 5.0
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
ModerateCVE-2016-0718SUSE bug 979441SUSE bug 991809cpe:/o:suse:suse-microos:5.0CVE-2016-0749SUSE Linux Enterprise Micro 5.0
The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.
ImportantCVE-2016-0749SUSE bug 982385SUSE bug 982386cpe:/o:suse:suse-microos:5.0CVE-2016-0755SUSE Linux Enterprise Micro 5.0
The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.
ModerateCVE-2016-0755SUSE bug 962983cpe:/o:suse:suse-microos:5.0CVE-2016-0764SUSE Linux Enterprise Micro 5.0
Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary files during ifcfg and keyfile changes.
LowCVE-2016-0764SUSE bug 974072cpe:/o:suse:suse-microos:5.0CVE-2016-0772SUSE Linux Enterprise Micro 5.0
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
ModerateCVE-2016-0772SUSE bug 984751cpe:/o:suse:suse-microos:5.0CVE-2016-0777SUSE Linux Enterprise Micro 5.0
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.
CriticalCVE-2016-0777SUSE bug 961642SUSE bug 996040cpe:/o:suse:suse-microos:5.0CVE-2016-0778SUSE Linux Enterprise Micro 5.0
The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.
ImportantCVE-2016-0778SUSE bug 961645SUSE bug 996040cpe:/o:suse:suse-microos:5.0CVE-2016-0787SUSE Linux Enterprise Micro 5.0
The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."
ModerateCVE-2016-0787SUSE bug 1149968SUSE bug 967026SUSE bug 968174SUSE bug 974691cpe:/o:suse:suse-microos:5.0CVE-2016-0797SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.
ImportantCVE-2016-0797SUSE bug 968044SUSE bug 968048SUSE bug 990370cpe:/o:suse:suse-microos:5.0CVE-2016-0798SUSE Linux Enterprise Micro 5.0
Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt, related to apps/s_server.c and crypto/srp/srp_vfy.c.
ImportantCVE-2016-0798SUSE bug 968044SUSE bug 968265cpe:/o:suse:suse-microos:5.0CVE-2016-0800SUSE Linux Enterprise Micro 5.0
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.
ModerateCVE-2016-0800SUSE bug 1106871SUSE bug 961377SUSE bug 968044SUSE bug 968046SUSE bug 968888SUSE bug 969591SUSE bug 979060cpe:/o:suse:suse-microos:5.0CVE-2016-0821SUSE Linux Enterprise Micro 5.0
The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialized list entry, aka Android internal bug 26186802, a different vulnerability than CVE-2015-3636.
LowCVE-2016-0821SUSE bug 987709SUSE bug 994624cpe:/o:suse:suse-microos:5.0CVE-2016-1000110SUSE Linux Enterprise Micro 5.0
The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.
ModerateCVE-2016-1000110SUSE bug 988484SUSE bug 989523cpe:/o:suse:suse-microos:5.0CVE-2016-10009SUSE Linux Enterprise Micro 5.0
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
ModerateCVE-2016-10009SUSE bug 1016336SUSE bug 1016366SUSE bug 1016370SUSE bug 1026634SUSE bug 1138392SUSE bug 1213504cpe:/o:suse:suse-microos:5.0CVE-2016-10010SUSE Linux Enterprise Micro 5.0
sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.
ImportantCVE-2016-10010SUSE bug 1016336SUSE bug 1016368SUSE bug 1021751SUSE bug 1196721cpe:/o:suse:suse-microos:5.0CVE-2016-10011SUSE Linux Enterprise Micro 5.0
authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.
LowCVE-2016-10011SUSE bug 1016336SUSE bug 1016369SUSE bug 1016370SUSE bug 1017870SUSE bug 1026634SUSE bug 1029445cpe:/o:suse:suse-microos:5.0CVE-2016-10012SUSE Linux Enterprise Micro 5.0
The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.
LowCVE-2016-10012SUSE bug 1006166SUSE bug 1016336SUSE bug 1016369SUSE bug 1016370SUSE bug 1017870SUSE bug 1026634SUSE bug 1035742SUSE bug 1073044SUSE bug 1092582SUSE bug 1138392cpe:/o:suse:suse-microos:5.0CVE-2016-10013SUSE Linux Enterprise Micro 5.0
Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.
ModerateCVE-2016-10013SUSE bug 1016340cpe:/o:suse:suse-microos:5.0CVE-2016-10024SUSE Linux Enterprise Micro 5.0
Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.
ModerateCVE-2016-10024SUSE bug 1014298SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2016-10025SUSE Linux Enterprise Micro 5.0
VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.
ModerateCVE-2016-10025SUSE bug 1014300cpe:/o:suse:suse-microos:5.0CVE-2016-10028SUSE Linux Enterprise Micro 5.0
The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0.
ModerateCVE-2016-10028SUSE bug 1017084SUSE bug 1017085SUSE bug 1185981cpe:/o:suse:suse-microos:5.0CVE-2016-10029SUSE Linux Enterprise Micro 5.0
The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a scanout id in a VIRTIO_GPU_CMD_SET_SCANOUT command larger than num_scanouts.
ModerateCVE-2016-10029SUSE bug 1017081SUSE bug 1017082cpe:/o:suse:suse-microos:5.0CVE-2016-10044SUSE Linux Enterprise Micro 5.0
The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.
LowCVE-2016-10044SUSE bug 1023992cpe:/o:suse:suse-microos:5.0CVE-2016-10087SUSE Linux Enterprise Micro 5.0
The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.
LowCVE-2016-10087SUSE bug 1017646SUSE bug 1149680cpe:/o:suse:suse-microos:5.0CVE-2016-10147SUSE Linux Enterprise Micro 5.0
crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an AF_ALG socket with an incompatible algorithm, as demonstrated by mcryptd(md5).
ModerateCVE-2016-10147SUSE bug 1020381SUSE bug 1020429cpe:/o:suse:suse-microos:5.0CVE-2016-10155SUSE Linux Enterprise Micro 5.0
Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
LowCVE-2016-10155SUSE bug 1021129SUSE bug 1024183cpe:/o:suse:suse-microos:5.0CVE-2016-10156SUSE Linux Enterprise Micro 5.0
A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.
ImportantCVE-2016-10156SUSE bug 1020601SUSE bug 1021969SUSE bug 1086936cpe:/o:suse:suse-microos:5.0CVE-2016-10198SUSE Linux Enterprise Micro 5.0
The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted audio file.
LowCVE-2016-10198SUSE bug 1023259SUSE bug 1024014cpe:/o:suse:suse-microos:5.0CVE-2016-10199SUSE Linux Enterprise Micro 5.0
The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value.
LowCVE-2016-10199SUSE bug 1023259SUSE bug 1024017cpe:/o:suse:suse-microos:5.0CVE-2016-10208SUSE Linux Enterprise Micro 5.0
The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image.
ImportantCVE-2016-10208SUSE bug 1023377SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2016-10214SUSE Linux Enterprise Micro 5.0
Memory leak in the virgl_resource_attach_backing function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
ModerateCVE-2016-10214SUSE bug 1024244cpe:/o:suse:suse-microos:5.0CVE-2016-10228SUSE Linux Enterprise Micro 5.0
The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.
LowCVE-2016-10228SUSE bug 1027496SUSE bug 1123874cpe:/o:suse:suse-microos:5.0CVE-2016-10739SUSE Linux Enterprise Micro 5.0
In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.
ModerateCVE-2016-10739SUSE bug 1122729SUSE bug 1155094cpe:/o:suse:suse-microos:5.0CVE-2016-10741SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure.
ModerateCVE-2016-10741SUSE bug 1114920SUSE bug 1124010cpe:/o:suse:suse-microos:5.0CVE-2016-10745SUSE Linux Enterprise Micro 5.0
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
ImportantCVE-2016-10745SUSE bug 1132174cpe:/o:suse:suse-microos:5.0CVE-2016-10746SUSE Linux Enterprise Micro 5.0
libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886.
ModerateCVE-2016-10746SUSE bug 1133150cpe:/o:suse:suse-microos:5.0CVE-2016-10905SUSE Linux Enterprise Micro 5.0
An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.
ModerateCVE-2016-10905SUSE bug 1146312cpe:/o:suse:suse-microos:5.0CVE-2016-10906SUSE Linux Enterprise Micro 5.0
An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean.
ModerateCVE-2016-10906SUSE bug 1146584cpe:/o:suse:suse-microos:5.0CVE-2016-10907SUSE Linux Enterprise Micro 5.0
An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt.
ImportantCVE-2016-10907SUSE bug 1146302cpe:/o:suse:suse-microos:5.0CVE-2016-1234SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name.
ModerateCVE-2016-1234SUSE bug 1020940SUSE bug 969727SUSE bug 988770SUSE bug 988782SUSE bug 989127cpe:/o:suse:suse-microos:5.0CVE-2016-1237SUSE Linux Enterprise Micro 5.0
nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.
LowCVE-2016-1237SUSE bug 986570cpe:/o:suse:suse-microos:5.0CVE-2016-1238SUSE Linux Enterprise Micro 5.0
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
ModerateCVE-2016-1238SUSE bug 1108749SUSE bug 1123389SUSE bug 987887SUSE bug 988311cpe:/o:suse:suse-microos:5.0CVE-2016-1283SUSE Linux Enterprise Micro 5.0
The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CriticalCVE-2016-1283SUSE bug 960837cpe:/o:suse:suse-microos:5.0CVE-2016-1521SUSE Linux Enterprise Micro 5.0
The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.
ModerateCVE-2016-1521SUSE bug 965803SUSE bug 965806SUSE bug 965807SUSE bug 965810cpe:/o:suse:suse-microos:5.0CVE-2016-1544SUSE Linux Enterprise Micro 5.0
nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).
LowCVE-2016-1544SUSE bug 966514cpe:/o:suse:suse-microos:5.0CVE-2016-1567SUSE Linux Enterprise Micro 5.0
chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."
ImportantCVE-2016-1567cpe:/o:suse:suse-microos:5.0CVE-2016-1568SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.
ModerateCVE-2016-1568SUSE bug 961332SUSE bug 961333cpe:/o:suse:suse-microos:5.0CVE-2016-1570SUSE Linux Enterprise Micro 5.0
The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.
ImportantCVE-2016-1570SUSE bug 960861cpe:/o:suse:suse-microos:5.0CVE-2016-1571SUSE Linux Enterprise Micro 5.0
The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.
LowCVE-2016-1571SUSE bug 960861SUSE bug 960862cpe:/o:suse:suse-microos:5.0CVE-2016-1575SUSE Linux Enterprise Micro 5.0
The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.
ImportantCVE-2016-1575SUSE bug 968092cpe:/o:suse:suse-microos:5.0CVE-2016-1583SUSE Linux Enterprise Micro 5.0
The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.
ImportantCVE-2016-1583SUSE bug 1020452SUSE bug 1052256SUSE bug 983143SUSE bug 983144cpe:/o:suse:suse-microos:5.0CVE-2016-1714SUSE Linux Enterprise Micro 5.0
The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.
ModerateCVE-2016-1714SUSE bug 961691SUSE bug 961692cpe:/o:suse:suse-microos:5.0CVE-2016-1762SUSE Linux Enterprise Micro 5.0
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.
ModerateCVE-2016-1762SUSE bug 1123919SUSE bug 981040cpe:/o:suse:suse-microos:5.0CVE-2016-1833SUSE Linux Enterprise Micro 5.0
The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.
ImportantCVE-2016-1833SUSE bug 1123919SUSE bug 981108cpe:/o:suse:suse-microos:5.0CVE-2016-1834SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
ModerateCVE-2016-1834SUSE bug 1123919SUSE bug 981041cpe:/o:suse:suse-microos:5.0CVE-2016-1835SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.
ImportantCVE-2016-1835SUSE bug 1123919SUSE bug 981109cpe:/o:suse:suse-microos:5.0CVE-2016-1836SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document.
ImportantCVE-2016-1836SUSE bug 1174862SUSE bug 981110cpe:/o:suse:suse-microos:5.0CVE-2016-1837SUSE Linux Enterprise Micro 5.0
Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document.
ImportantCVE-2016-1837SUSE bug 1123919SUSE bug 981111cpe:/o:suse:suse-microos:5.0CVE-2016-1838SUSE Linux Enterprise Micro 5.0
The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.
ImportantCVE-2016-1838SUSE bug 1123919SUSE bug 981112cpe:/o:suse:suse-microos:5.0CVE-2016-1839SUSE Linux Enterprise Micro 5.0
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.
ModerateCVE-2016-1839SUSE bug 1039069SUSE bug 1039661SUSE bug 1069433SUSE bug 1069690SUSE bug 1123919SUSE bug 963963SUSE bug 981114cpe:/o:suse:suse-microos:5.0CVE-2016-1840SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
ImportantCVE-2016-1840SUSE bug 1123919SUSE bug 981115cpe:/o:suse:suse-microos:5.0CVE-2016-1866SUSE Linux Enterprise Micro 5.0
Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
ImportantCVE-2016-1866SUSE bug 965403cpe:/o:suse:suse-microos:5.0CVE-2016-1922SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'current_cpu' remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in DoS issue.
LowCVE-2016-1922SUSE bug 962320SUSE bug 962321cpe:/o:suse:suse-microos:5.0CVE-2016-1950SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
ImportantCVE-2016-1950SUSE bug 969894SUSE bug 970257SUSE bug 970377SUSE bug 970378SUSE bug 970379SUSE bug 970380SUSE bug 970381SUSE bug 970431SUSE bug 970433cpe:/o:suse:suse-microos:5.0CVE-2016-1979SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.
ImportantCVE-2016-1979SUSE bug 969894cpe:/o:suse:suse-microos:5.0CVE-2016-1981SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.
LowCVE-2016-1981SUSE bug 963782SUSE bug 963783cpe:/o:suse:suse-microos:5.0CVE-2016-2037SUSE Linux Enterprise Micro 5.0
The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.
LowCVE-2016-2037SUSE bug 1028410SUSE bug 963448cpe:/o:suse:suse-microos:5.0CVE-2016-2105SUSE Linux Enterprise Micro 5.0
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.
LowCVE-2016-2105SUSE bug 977584SUSE bug 977614SUSE bug 978492SUSE bug 989902SUSE bug 990369SUSE bug 990370cpe:/o:suse:suse-microos:5.0CVE-2016-2106SUSE Linux Enterprise Micro 5.0
Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.
LowCVE-2016-2106SUSE bug 977584SUSE bug 977615SUSE bug 978492SUSE bug 979279SUSE bug 990369cpe:/o:suse:suse-microos:5.0CVE-2016-2107SUSE Linux Enterprise Micro 5.0
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
ImportantCVE-2016-2107SUSE bug 976942SUSE bug 977584SUSE bug 977616SUSE bug 978492SUSE bug 990369SUSE bug 990370cpe:/o:suse:suse-microos:5.0CVE-2016-2109SUSE Linux Enterprise Micro 5.0
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.
ModerateCVE-2016-2109SUSE bug 1015243SUSE bug 976942SUSE bug 977584SUSE bug 978492SUSE bug 990369cpe:/o:suse:suse-microos:5.0CVE-2016-2150SUSE Linux Enterprise Micro 5.0
SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.
ImportantCVE-2016-2150SUSE bug 982385SUSE bug 982386cpe:/o:suse:suse-microos:5.0CVE-2016-2176SUSE Linux Enterprise Micro 5.0
The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.
ImportantCVE-2016-2176SUSE bug 978224SUSE bug 990369cpe:/o:suse:suse-microos:5.0CVE-2016-2177SUSE Linux Enterprise Micro 5.0
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.
ImportantCVE-2016-2177SUSE bug 982575SUSE bug 999075SUSE bug 999665cpe:/o:suse:suse-microos:5.0CVE-2016-2178SUSE Linux Enterprise Micro 5.0
The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.
LowCVE-2016-2178SUSE bug 1004104SUSE bug 983249SUSE bug 983519SUSE bug 999665cpe:/o:suse:suse-microos:5.0CVE-2016-2179SUSE Linux Enterprise Micro 5.0
The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.
ModerateCVE-2016-2179SUSE bug 1004104SUSE bug 994844SUSE bug 999665cpe:/o:suse:suse-microos:5.0CVE-2016-2180SUSE Linux Enterprise Micro 5.0
The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command.
LowCVE-2016-2180SUSE bug 1003811SUSE bug 990419SUSE bug 999665cpe:/o:suse:suse-microos:5.0CVE-2016-2181SUSE Linux Enterprise Micro 5.0
The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.
LowCVE-2016-2181SUSE bug 1004104SUSE bug 994749SUSE bug 994844SUSE bug 999665cpe:/o:suse:suse-microos:5.0CVE-2016-2182SUSE Linux Enterprise Micro 5.0
The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
LowCVE-2016-2182SUSE bug 1004104SUSE bug 993819SUSE bug 994844SUSE bug 995959SUSE bug 999665cpe:/o:suse:suse-microos:5.0CVE-2016-2183SUSE Linux Enterprise Micro 5.0
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
ModerateCVE-2016-2183SUSE bug 1001912SUSE bug 1024218SUSE bug 1027038SUSE bug 1034689SUSE bug 1056614SUSE bug 1171693SUSE bug 994844SUSE bug 995359cpe:/o:suse:suse-microos:5.0CVE-2016-2187SUSE Linux Enterprise Micro 5.0
The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
ModerateCVE-2016-2187SUSE bug 1020452SUSE bug 971919SUSE bug 971944cpe:/o:suse:suse-microos:5.0CVE-2016-2198SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS.
LowCVE-2016-2198SUSE bug 964413SUSE bug 964415cpe:/o:suse:suse-microos:5.0CVE-2016-2270SUSE Linux Enterprise Micro 5.0
Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.
LowCVE-2016-2270SUSE bug 965315cpe:/o:suse:suse-microos:5.0CVE-2016-2271SUSE Linux Enterprise Micro 5.0
VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP.
LowCVE-2016-2271SUSE bug 965317cpe:/o:suse:suse-microos:5.0CVE-2016-2384SUSE Linux Enterprise Micro 5.0
Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.
ModerateCVE-2016-2384SUSE bug 1020452SUSE bug 966693SUSE bug 967773cpe:/o:suse:suse-microos:5.0CVE-2016-2391SUSE Linux Enterprise Micro 5.0
The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.
LowCVE-2016-2391SUSE bug 967012SUSE bug 967013SUSE bug 967101cpe:/o:suse:suse-microos:5.0CVE-2016-2392SUSE Linux Enterprise Micro 5.0
The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.
LowCVE-2016-2392SUSE bug 967012SUSE bug 967090cpe:/o:suse:suse-microos:5.0CVE-2016-2538SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.
ImportantCVE-2016-2538SUSE bug 967969SUSE bug 968004cpe:/o:suse:suse-microos:5.0CVE-2016-2779SUSE Linux Enterprise Micro 5.0
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
ImportantCVE-2016-2779SUSE bug 1000998SUSE bug 1018892SUSE bug 946429SUSE bug 968375SUSE bug 968674SUSE bug 968675cpe:/o:suse:suse-microos:5.0CVE-2016-2782SUSE Linux Enterprise Micro 5.0
The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.
LowCVE-2016-2782SUSE bug 1020452SUSE bug 961512SUSE bug 968670cpe:/o:suse:suse-microos:5.0CVE-2016-2834SUSE Linux Enterprise Micro 5.0
Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
ModerateCVE-2016-2834SUSE bug 983549SUSE bug 983639cpe:/o:suse:suse-microos:5.0CVE-2016-2841SUSE Linux Enterprise Micro 5.0
The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.
LowCVE-2016-2841SUSE bug 969350SUSE bug 969351cpe:/o:suse:suse-microos:5.0CVE-2016-3044SUSE Linux Enterprise Micro 5.0
The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of service (host OS infinite loop and hang) via unspecified vectors.
ModerateCVE-2016-3044SUSE bug 1013013cpe:/o:suse:suse-microos:5.0CVE-2016-3070SUSE Linux Enterprise Micro 5.0
The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move.
LowCVE-2016-3070SUSE bug 979215cpe:/o:suse:suse-microos:5.0CVE-2016-3075SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name.
LowCVE-2016-3075SUSE bug 1123874SUSE bug 973164cpe:/o:suse:suse-microos:5.0CVE-2016-3115SUSE Linux Enterprise Micro 5.0
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.
ModerateCVE-2016-3115SUSE bug 1005738SUSE bug 1059233SUSE bug 1138392SUSE bug 970632SUSE bug 992296SUSE bug 992991SUSE bug 996040cpe:/o:suse:suse-microos:5.0CVE-2016-3119SUSE Linux Enterprise Micro 5.0
The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.
ModerateCVE-2016-3119SUSE bug 971942cpe:/o:suse:suse-microos:5.0CVE-2016-3120SUSE Linux Enterprise Micro 5.0
The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.
LowCVE-2016-3120SUSE bug 991088cpe:/o:suse:suse-microos:5.0CVE-2016-3134SUSE Linux Enterprise Micro 5.0
The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.
ModerateCVE-2016-3134SUSE bug 1020452SUSE bug 1052256SUSE bug 1115893SUSE bug 971126SUSE bug 971793SUSE bug 986362SUSE bug 986365SUSE bug 986377cpe:/o:suse:suse-microos:5.0CVE-2016-3139SUSE Linux Enterprise Micro 5.0
The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
ModerateCVE-2016-3139SUSE bug 1020452SUSE bug 970909cpe:/o:suse:suse-microos:5.0CVE-2016-3189SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
LowCVE-2016-3189SUSE bug 985657cpe:/o:suse:suse-microos:5.0CVE-2016-3191SUSE Linux Enterprise Micro 5.0
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.
LowCVE-2016-3191SUSE bug 971741cpe:/o:suse:suse-microos:5.0CVE-2016-3627SUSE Linux Enterprise Micro 5.0
The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document.
ModerateCVE-2016-3627SUSE bug 1026099SUSE bug 1026101SUSE bug 1123919SUSE bug 972335SUSE bug 975947cpe:/o:suse:suse-microos:5.0CVE-2016-3697SUSE Linux Enterprise Micro 5.0
libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.
ModerateCVE-2016-3697SUSE bug 976777cpe:/o:suse:suse-microos:5.0CVE-2016-3705SUSE Linux Enterprise Micro 5.0
The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references.
LowCVE-2016-3705SUSE bug 1017497SUSE bug 1123919SUSE bug 975947cpe:/o:suse:suse-microos:5.0CVE-2016-3706SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458.
ModerateCVE-2016-3706SUSE bug 1123874SUSE bug 980483SUSE bug 997423cpe:/o:suse:suse-microos:5.0CVE-2016-3710SUSE Linux Enterprise Micro 5.0
The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.
ModerateCVE-2016-3710SUSE bug 978158SUSE bug 978164SUSE bug 978167cpe:/o:suse:suse-microos:5.0CVE-2016-3712SUSE Linux Enterprise Micro 5.0
Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode.
LowCVE-2016-3712SUSE bug 978160SUSE bug 978164SUSE bug 978167cpe:/o:suse:suse-microos:5.0CVE-2016-3841SUSE Linux Enterprise Micro 5.0
The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call.
ModerateCVE-2016-3841SUSE bug 1052256SUSE bug 1115893SUSE bug 992566SUSE bug 992569cpe:/o:suse:suse-microos:5.0CVE-2016-3951SUSE Linux Enterprise Micro 5.0
Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor.
ModerateCVE-2016-3951SUSE bug 974418cpe:/o:suse:suse-microos:5.0CVE-2016-4002SUSE Linux Enterprise Micro 5.0
Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.
ModerateCVE-2016-4002SUSE bug 975136SUSE bug 975138cpe:/o:suse:suse-microos:5.0CVE-2016-4008SUSE Linux Enterprise Micro 5.0
The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate.
ModerateCVE-2016-4008SUSE bug 982779cpe:/o:suse:suse-microos:5.0CVE-2016-4020SUSE Linux Enterprise Micro 5.0
The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).
LowCVE-2016-4020SUSE bug 975700SUSE bug 975907cpe:/o:suse:suse-microos:5.0CVE-2016-4429SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.
LowCVE-2016-4429SUSE bug 1081556SUSE bug 1123874SUSE bug 980854cpe:/o:suse:suse-microos:5.0CVE-2016-4439SUSE Linux Enterprise Micro 5.0
The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors.
LowCVE-2016-4439SUSE bug 980711SUSE bug 980716cpe:/o:suse:suse-microos:5.0CVE-2016-4440SUSE Linux Enterprise Micro 5.0
arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode.
ModerateCVE-2016-4440SUSE bug 980829cpe:/o:suse:suse-microos:5.0CVE-2016-4441SUSE Linux Enterprise Micro 5.0
The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command.
LowCVE-2016-4441SUSE bug 980723SUSE bug 980724cpe:/o:suse:suse-microos:5.0CVE-2016-4453SUSE Linux Enterprise Micro 5.0
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.
LowCVE-2016-4453SUSE bug 982223SUSE bug 982225cpe:/o:suse:suse-microos:5.0CVE-2016-4454SUSE Linux Enterprise Micro 5.0
The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read.
LowCVE-2016-4454SUSE bug 982222SUSE bug 982224cpe:/o:suse:suse-microos:5.0CVE-2016-4472SUSE Linux Enterprise Micro 5.0
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
ModerateCVE-2016-4472SUSE bug 1034050SUSE bug 939077SUSE bug 980391SUSE bug 983985cpe:/o:suse:suse-microos:5.0CVE-2016-4476SUSE Linux Enterprise Micro 5.0
hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.
LowCVE-2016-4476SUSE bug 978172cpe:/o:suse:suse-microos:5.0CVE-2016-4477SUSE Linux Enterprise Micro 5.0
wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.
ModerateCVE-2016-4477SUSE bug 978175cpe:/o:suse:suse-microos:5.0CVE-2016-4480SUSE Linux Enterprise Micro 5.0
The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory.
ImportantCVE-2016-4480SUSE bug 1072198SUSE bug 1072223SUSE bug 978288SUSE bug 978295cpe:/o:suse:suse-microos:5.0CVE-2016-4482SUSE Linux Enterprise Micro 5.0
The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call.
LowCVE-2016-4482SUSE bug 1020452SUSE bug 978401SUSE bug 978445cpe:/o:suse:suse-microos:5.0CVE-2016-4483SUSE Linux Enterprise Micro 5.0
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.
LowCVE-2016-4483SUSE bug 1026101SUSE bug 1123919SUSE bug 978395cpe:/o:suse:suse-microos:5.0CVE-2016-4485SUSE Linux Enterprise Micro 5.0
The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message.
ModerateCVE-2016-4485SUSE bug 1020452SUSE bug 978821cpe:/o:suse:suse-microos:5.0CVE-2016-4565SUSE Linux Enterprise Micro 5.0
The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface.
ModerateCVE-2016-4565SUSE bug 1020452SUSE bug 979548SUSE bug 980363SUSE bug 980883cpe:/o:suse:suse-microos:5.0CVE-2016-4568SUSE Linux Enterprise Micro 5.0
drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted number of planes in a VIDIOC_DQBUF ioctl call.
ModerateCVE-2016-4568SUSE bug 979022SUSE bug 981516cpe:/o:suse:suse-microos:5.0CVE-2016-4569SUSE Linux Enterprise Micro 5.0
The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface.
LowCVE-2016-4569SUSE bug 1020452SUSE bug 979213SUSE bug 979879cpe:/o:suse:suse-microos:5.0CVE-2016-4574SUSE Linux Enterprise Micro 5.0
Off-by-one error in the append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read) via invalid utf-8 encoded data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-4356.
ImportantCVE-2016-4574SUSE bug 1135436SUSE bug 979261cpe:/o:suse:suse-microos:5.0CVE-2016-4579SUSE Linux Enterprise Micro 5.0
Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors, related to the "returned length of the object from _ksba_ber_parse_tl."
ModerateCVE-2016-4579SUSE bug 1135436SUSE bug 979906cpe:/o:suse:suse-microos:5.0CVE-2016-4658SUSE Linux Enterprise Micro 5.0
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
ModerateCVE-2016-4658SUSE bug 1005544SUSE bug 1014873SUSE bug 1069433SUSE bug 1078813SUSE bug 1123919cpe:/o:suse:suse-microos:5.0CVE-2016-4738SUSE Linux Enterprise Micro 5.0
libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
ModerateCVE-2016-4738SUSE bug 1005591SUSE bug 1123130cpe:/o:suse:suse-microos:5.0CVE-2016-4794SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls.
ModerateCVE-2016-4794SUSE bug 980265SUSE bug 981517cpe:/o:suse:suse-microos:5.0CVE-2016-4804SUSE Linux Enterprise Micro 5.0
The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function.
LowCVE-2016-4804SUSE bug 980364SUSE bug 980377cpe:/o:suse:suse-microos:5.0CVE-2016-4912SUSE Linux Enterprise Micro 5.0
The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.
ModerateCVE-2016-4912SUSE bug 1074356SUSE bug 980722cpe:/o:suse:suse-microos:5.0CVE-2016-4952SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds array access) via vectors related to the (1) PVSCSI_CMD_SETUP_RINGS or (2) PVSCSI_CMD_SETUP_MSG_RING SCSI command.
LowCVE-2016-4952SUSE bug 981266SUSE bug 981276cpe:/o:suse:suse-microos:5.0CVE-2016-4964SUSE Linux Enterprise Micro 5.0
The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop, and CPU consumption or QEMU process crash) via vectors involving s->state.
ModerateCVE-2016-4964SUSE bug 981399SUSE bug 981401cpe:/o:suse:suse-microos:5.0CVE-2016-5011SUSE Linux Enterprise Micro 5.0
The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset.
LowCVE-2016-5011SUSE bug 988361cpe:/o:suse:suse-microos:5.0CVE-2016-5105SUSE Linux Enterprise Micro 5.0
The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized variable, which allows local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command.
LowCVE-2016-5105SUSE bug 982017SUSE bug 982024cpe:/o:suse:suse-microos:5.0CVE-2016-5106SUSE Linux Enterprise Micro 5.0
The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command.
LowCVE-2016-5106SUSE bug 982018SUSE bug 982025cpe:/o:suse:suse-microos:5.0CVE-2016-5107SUSE Linux Enterprise Micro 5.0
The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors.
LowCVE-2016-5107SUSE bug 982019SUSE bug 982026cpe:/o:suse:suse-microos:5.0CVE-2016-5126SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.
LowCVE-2016-5126SUSE bug 982285SUSE bug 982286cpe:/o:suse:suse-microos:5.0CVE-2016-5238SUSE Linux Enterprise Micro 5.0
The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode.
ModerateCVE-2016-5238SUSE bug 982959SUSE bug 982960cpe:/o:suse:suse-microos:5.0CVE-2016-5244SUSE Linux Enterprise Micro 5.0
The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.
ModerateCVE-2016-5244SUSE bug 983213SUSE bug 986225cpe:/o:suse:suse-microos:5.0CVE-2016-5300SUSE Linux Enterprise Micro 5.0
The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.
ImportantCVE-2016-5300SUSE bug 983216cpe:/o:suse:suse-microos:5.0CVE-2016-5337SUSE Linux Enterprise Micro 5.0
The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information.
LowCVE-2016-5337SUSE bug 983961SUSE bug 983973cpe:/o:suse:suse-microos:5.0CVE-2016-5338SUSE Linux Enterprise Micro 5.0
The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer.
LowCVE-2016-5338SUSE bug 983982SUSE bug 983984cpe:/o:suse:suse-microos:5.0CVE-2016-5389SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5696. Reason: This candidate is a reservation duplicate of CVE-2016-5696. Notes: All CVE users should reference CVE-2016-5696 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
ModerateCVE-2016-5389cpe:/o:suse:suse-microos:5.0CVE-2016-5403SUSE Linux Enterprise Micro 5.0
The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.
LowCVE-2016-5403SUSE bug 990923SUSE bug 991080cpe:/o:suse:suse-microos:5.0CVE-2016-5407SUSE Linux Enterprise Micro 5.0
The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data.
ModerateCVE-2016-5407SUSE bug 1003017SUSE bug 1123148cpe:/o:suse:suse-microos:5.0CVE-2016-5410SUSE Linux Enterprise Micro 5.0
firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.
LowCVE-2016-5410SUSE bug 992772cpe:/o:suse:suse-microos:5.0CVE-2016-5412SUSE Linux Enterprise Micro 5.0
arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to cause a denial of service (host OS infinite loop) by making a H_CEDE hypercall during the existence of a suspended transaction.
ModerateCVE-2016-5412SUSE bug 1013013SUSE bug 991065cpe:/o:suse:suse-microos:5.0CVE-2016-5417SUSE Linux Enterprise Micro 5.0
Memory leak in the __res_vinit function in the IPv6 name server management code in libresolv in GNU C Library (aka glibc or libc6) before 2.24 allows remote attackers to cause a denial of service (memory consumption) by leveraging partial initialization of internal resolver data structures.
ImportantCVE-2016-5417SUSE bug 1123874SUSE bug 991670cpe:/o:suse:suse-microos:5.0CVE-2016-5636SUSE Linux Enterprise Micro 5.0
Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.
ImportantCVE-2016-5636SUSE bug 1065451SUSE bug 1106262SUSE bug 985177cpe:/o:suse:suse-microos:5.0CVE-2016-5696SUSE Linux Enterprise Micro 5.0
net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.
ModerateCVE-2016-5696SUSE bug 1020452SUSE bug 1175721SUSE bug 989152cpe:/o:suse:suse-microos:5.0CVE-2016-5699SUSE Linux Enterprise Micro 5.0
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
ModerateCVE-2016-5699SUSE bug 1122729SUSE bug 1130840SUSE bug 985348SUSE bug 985351SUSE bug 986630cpe:/o:suse:suse-microos:5.0CVE-2016-5735SUSE Linux Enterprise Micro 5.0
Integer overflow in the rwpng_read_image24_libpng function in rwpng.c in pngquant 2.7.0 allows remote attackers to have unspecified impact via a crafted PNG file, which triggers a buffer overflow.
ModerateCVE-2016-5735SUSE bug 1173616cpe:/o:suse:suse-microos:5.0CVE-2016-5759SUSE Linux Enterprise Micro 5.0
The mkdumprd script called "dracut" in the current working directory "." allows local users to trick the administrator into executing code as root.
ModerateCVE-2016-5759SUSE bug 990200cpe:/o:suse:suse-microos:5.0CVE-2016-5828SUSE Linux Enterprise Micro 5.0
The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local users to cause a denial of service (invalid process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by starting and suspending a transaction before an exec system call.
ModerateCVE-2016-5828SUSE bug 986569SUSE bug 991065cpe:/o:suse:suse-microos:5.0CVE-2016-6130SUSE Linux Enterprise Micro 5.0
Race condition in the sclp_ctl_ioctl_sccb function in drivers/s390/char/sclp_ctl.c in the Linux kernel before 4.6 allows local users to obtain sensitive information from kernel memory by changing a certain length value, aka a "double fetch" vulnerability.
ModerateCVE-2016-6130SUSE bug 987542cpe:/o:suse:suse-microos:5.0CVE-2016-6136SUSE Linux Enterprise Micro 5.0
Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability.
ModerateCVE-2016-6136SUSE bug 988153cpe:/o:suse:suse-microos:5.0CVE-2016-6197SUSE Linux Enterprise Micro 5.0
fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing, which allows local users to cause a denial of service (system crash) via a rename system call that specifies a self-hardlink.
ModerateCVE-2016-6197SUSE bug 988708cpe:/o:suse:suse-microos:5.0CVE-2016-6198SUSE Linux Enterprise Micro 5.0
The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c.
ModerateCVE-2016-6198SUSE bug 988708cpe:/o:suse:suse-microos:5.0CVE-2016-6210SUSE Linux Enterprise Micro 5.0
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
ModerateCVE-2016-6210SUSE bug 1001712SUSE bug 1105010SUSE bug 1138392SUSE bug 989363cpe:/o:suse:suse-microos:5.0CVE-2016-6213SUSE Linux Enterprise Micro 5.0
fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts.
LowCVE-2016-6213SUSE bug 988964cpe:/o:suse:suse-microos:5.0CVE-2016-6258SUSE Linux Enterprise Micro 5.0
The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries.
ImportantCVE-2016-6258SUSE bug 1072198SUSE bug 1072223SUSE bug 988675SUSE bug 988692cpe:/o:suse:suse-microos:5.0CVE-2016-6259SUSE Linux Enterprise Micro 5.0
Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check.
ModerateCVE-2016-6259SUSE bug 988676SUSE bug 988694cpe:/o:suse:suse-microos:5.0CVE-2016-6261SUSE Linux Enterprise Micro 5.0
The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.
LowCVE-2016-6261SUSE bug 1118435SUSE bug 1173590SUSE bug 990190cpe:/o:suse:suse-microos:5.0CVE-2016-6262SUSE Linux Enterprise Micro 5.0
idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948.
ModerateCVE-2016-6262SUSE bug 1014473SUSE bug 1173590SUSE bug 1190777SUSE bug 990189cpe:/o:suse:suse-microos:5.0CVE-2016-6263SUSE Linux Enterprise Micro 5.0
The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
LowCVE-2016-6263SUSE bug 1118435SUSE bug 990191cpe:/o:suse:suse-microos:5.0CVE-2016-6302SUSE Linux Enterprise Micro 5.0
The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.
ModerateCVE-2016-6302SUSE bug 1004104SUSE bug 994844SUSE bug 995324SUSE bug 999665cpe:/o:suse:suse-microos:5.0CVE-2016-6303SUSE Linux Enterprise Micro 5.0
Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
LowCVE-2016-6303SUSE bug 1004104SUSE bug 1115893SUSE bug 994844SUSE bug 995377SUSE bug 999665cpe:/o:suse:suse-microos:5.0CVE-2016-6304SUSE Linux Enterprise Micro 5.0
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
ModerateCVE-2016-6304SUSE bug 1001706SUSE bug 1003811SUSE bug 1004104SUSE bug 1005579SUSE bug 1021375SUSE bug 999665SUSE bug 999666cpe:/o:suse:suse-microos:5.0CVE-2016-6306SUSE Linux Enterprise Micro 5.0
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
LowCVE-2016-6306SUSE bug 1004104SUSE bug 999665SUSE bug 999668cpe:/o:suse:suse-microos:5.0CVE-2016-6313SUSE Linux Enterprise Micro 5.0
The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.
ModerateCVE-2016-6313SUSE bug 1123792SUSE bug 994157cpe:/o:suse:suse-microos:5.0CVE-2016-6318SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field, involving longbuffer.
ModerateCVE-2016-6318SUSE bug 1123113SUSE bug 992966cpe:/o:suse:suse-microos:5.0CVE-2016-6321SUSE Linux Enterprise Micro 5.0
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.
LowCVE-2016-6321SUSE bug 1007188SUSE bug 1123796cpe:/o:suse:suse-microos:5.0CVE-2016-6323SUSE Linux Enterprise Micro 5.0
The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms, which might allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.
ModerateCVE-2016-6323SUSE bug 994359cpe:/o:suse:suse-microos:5.0CVE-2016-6351SUSE Linux Enterprise Micro 5.0
The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer.
LowCVE-2016-6351SUSE bug 990835SUSE bug 990843cpe:/o:suse:suse-microos:5.0CVE-2016-6480SUSE Linux Enterprise Micro 5.0
Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a "double fetch" vulnerability.
ModerateCVE-2016-6480SUSE bug 1004418SUSE bug 991608SUSE bug 991667SUSE bug 992568cpe:/o:suse:suse-microos:5.0CVE-2016-6489SUSE Linux Enterprise Micro 5.0
The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack.
ModerateCVE-2016-6489SUSE bug 991464cpe:/o:suse:suse-microos:5.0CVE-2016-6490SUSE Linux Enterprise Micro 5.0
The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the descriptor buffer.
LowCVE-2016-6490SUSE bug 991466SUSE bug 993854cpe:/o:suse:suse-microos:5.0CVE-2016-6515SUSE Linux Enterprise Micro 5.0
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
ModerateCVE-2016-6515SUSE bug 1115893SUSE bug 992533cpe:/o:suse:suse-microos:5.0CVE-2016-6786SUSE Linux Enterprise Micro 5.0
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 30955111.
ModerateCVE-2016-6786SUSE bug 1015160SUSE bug 1025626cpe:/o:suse:suse-microos:5.0CVE-2016-6787SUSE Linux Enterprise Micro 5.0
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 31095224.
ModerateCVE-2016-6787SUSE bug 1015160cpe:/o:suse:suse-microos:5.0CVE-2016-6828SUSE Linux Enterprise Micro 5.0
The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option.
ModerateCVE-2016-6828SUSE bug 1052256SUSE bug 994296cpe:/o:suse:suse-microos:5.0CVE-2016-6833SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active.
ModerateCVE-2016-6833SUSE bug 994774SUSE bug 994775cpe:/o:suse:suse-microos:5.0CVE-2016-6836SUSE Linux Enterprise Micro 5.0
The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object.
LowCVE-2016-6836SUSE bug 994760SUSE bug 994761cpe:/o:suse:suse-microos:5.0CVE-2016-6888SUSE Linux Enterprise Micro 5.0
Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.
LowCVE-2016-6888SUSE bug 994771SUSE bug 994772cpe:/o:suse:suse-microos:5.0CVE-2016-7031SUSE Linux Enterprise Micro 5.0
The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.
LowCVE-2016-7031SUSE bug 997025cpe:/o:suse:suse-microos:5.0CVE-2016-7032SUSE Linux Enterprise Micro 5.0
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.
ModerateCVE-2016-7032SUSE bug 1007501SUSE bug 1007766SUSE bug 1011975SUSE bug 1011976cpe:/o:suse:suse-microos:5.0CVE-2016-7052SUSE Linux Enterprise Micro 5.0
crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CRL operation.
ImportantCVE-2016-7052SUSE bug 1001148cpe:/o:suse:suse-microos:5.0CVE-2016-7055SUSE Linux Enterprise Micro 5.0
There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is because the subroutine in question is not used in operations with the private key itself and an input of the attacker's direct choice. Otherwise the bug can manifest itself as transient authentication and key negotiation failures or reproducible erroneous outcome of public-key operations with specially crafted input. Among EC algorithms only Brainpool P-512 curves are affected and one presumably can attack ECDH key negotiation. Impact was not analyzed in detail, because pre-requisites for attack are considered unlikely. Namely multiple clients have to choose the curve in question and the server has to share the private key among them, neither of which is default behaviour. Even then only clients that chose the curve will be affected.
LowCVE-2016-7055SUSE bug 1009528SUSE bug 1021641cpe:/o:suse:suse-microos:5.0CVE-2016-7056SUSE Linux Enterprise Micro 5.0
A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.
ModerateCVE-2016-7056SUSE bug 1005878SUSE bug 1019334SUSE bug 1148697cpe:/o:suse:suse-microos:5.0CVE-2016-7076SUSE Linux Enterprise Micro 5.0
sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.
ModerateCVE-2016-7076SUSE bug 1007501SUSE bug 1011975SUSE bug 1011976cpe:/o:suse:suse-microos:5.0CVE-2016-7092SUSE Linux Enterprise Micro 5.0
The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables.
ImportantCVE-2016-7092SUSE bug 995785cpe:/o:suse:suse-microos:5.0CVE-2016-7093SUSE Linux Enterprise Micro 5.0
Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation.
ImportantCVE-2016-7093SUSE bug 995789cpe:/o:suse:suse-microos:5.0CVE-2016-7094SUSE Linux Enterprise Micro 5.0
Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update.
ModerateCVE-2016-7094SUSE bug 995792cpe:/o:suse:suse-microos:5.0CVE-2016-7097SUSE Linux Enterprise Micro 5.0
The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.
LowCVE-2016-7097SUSE bug 1021258SUSE bug 1052256SUSE bug 870618SUSE bug 995968cpe:/o:suse:suse-microos:5.0CVE-2016-7116SUSE Linux Enterprise Micro 5.0
Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string.
LowCVE-2016-7116SUSE bug 996441cpe:/o:suse:suse-microos:5.0CVE-2016-7117SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing.
ModerateCVE-2016-7117SUSE bug 1003077SUSE bug 1003253SUSE bug 1057478SUSE bug 1071943cpe:/o:suse:suse-microos:5.0CVE-2016-7155SUSE Linux Enterprise Micro 5.0
hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds access or infinite loop, and QEMU process crash) via a crafted page count for descriptor rings.
ModerateCVE-2016-7155SUSE bug 997858cpe:/o:suse:suse-microos:5.0CVE-2016-7156SUSE Linux Enterprise Micro 5.0
The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast.
ModerateCVE-2016-7156SUSE bug 997859cpe:/o:suse:suse-microos:5.0CVE-2016-7157SUSE Linux Enterprise Micro 5.0
The (1) mptsas_config_manufacturing_1 and (2) mptsas_config_ioc_0 functions in hw/scsi/mptconfig.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via vectors involving MPTSAS_CONFIG_PACK.
ModerateCVE-2016-7157SUSE bug 997860cpe:/o:suse:suse-microos:5.0CVE-2016-7161SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attackers to execute arbitrary code on the QEMU host via a large ethlite packet.
ModerateCVE-2016-7161SUSE bug 1001151SUSE bug 1001152cpe:/o:suse:suse-microos:5.0CVE-2016-7167SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.
ModerateCVE-2016-7167SUSE bug 998760cpe:/o:suse:suse-microos:5.0CVE-2016-7170SUSE Linux Enterprise Micro 5.0
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.
ModerateCVE-2016-7170SUSE bug 998516cpe:/o:suse:suse-microos:5.0CVE-2016-7421SUSE Linux Enterprise Micro 5.0
The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size.
LowCVE-2016-7421SUSE bug 999661cpe:/o:suse:suse-microos:5.0CVE-2016-7422SUSE Linux Enterprise Micro 5.0
The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via a large I/O descriptor buffer length value.
ModerateCVE-2016-7422SUSE bug 1000346cpe:/o:suse:suse-microos:5.0CVE-2016-7423SUSE Linux Enterprise Micro 5.0
The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects.
ModerateCVE-2016-7423SUSE bug 1000397cpe:/o:suse:suse-microos:5.0CVE-2016-7425SUSE Linux Enterprise Micro 5.0
The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.
ModerateCVE-2016-7425SUSE bug 1115893SUSE bug 999932cpe:/o:suse:suse-microos:5.0CVE-2016-7466SUSE Linux Enterprise Micro 5.0
Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device.
ModerateCVE-2016-7466SUSE bug 1000345cpe:/o:suse:suse-microos:5.0CVE-2016-7545SUSE Linux Enterprise Micro 5.0
SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
ModerateCVE-2016-7545SUSE bug 1000998SUSE bug 968375SUSE bug 968674cpe:/o:suse:suse-microos:5.0CVE-2016-7567SUSE Linux Enterprise Micro 5.0
Buffer overflow in the SLPFoldWhiteSpace function in common/slp_compare.c in OpenSLP 2.0 allows remote attackers to have unspecified impact via a crafted string.
ModerateCVE-2016-7567SUSE bug 1001600SUSE bug 1074356cpe:/o:suse:suse-microos:5.0CVE-2016-7777SUSE Linux Enterprise Micro 5.0
Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it.
ModerateCVE-2016-7777SUSE bug 1000106cpe:/o:suse:suse-microos:5.0CVE-2016-7837SUSE Linux Enterprise Micro 5.0
Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.
ModerateCVE-2016-7837SUSE bug 1026652cpe:/o:suse:suse-microos:5.0CVE-2016-7907SUSE Linux Enterprise Micro 5.0
The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
ModerateCVE-2016-7907SUSE bug 1002549cpe:/o:suse:suse-microos:5.0CVE-2016-7908SUSE Linux Enterprise Micro 5.0
The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
ModerateCVE-2016-7908SUSE bug 1002550SUSE bug 1003030cpe:/o:suse:suse-microos:5.0CVE-2016-7909SUSE Linux Enterprise Micro 5.0
The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0.
ModerateCVE-2016-7909SUSE bug 1002557SUSE bug 1003032cpe:/o:suse:suse-microos:5.0CVE-2016-7910SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.
ModerateCVE-2016-7910SUSE bug 1010716SUSE bug 1115893SUSE bug 1196722cpe:/o:suse:suse-microos:5.0CVE-2016-7913SUSE Linux Enterprise Micro 5.0
The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving omission of the firmware name from a certain data structure.
ImportantCVE-2016-7913SUSE bug 1010478cpe:/o:suse:suse-microos:5.0CVE-2016-7916SUSE Linux Enterprise Micro 5.0
Race condition in the environ_read function in fs/proc/base.c in the Linux kernel before 4.5.4 allows local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file during a process-setup time interval in which environment-variable copying is incomplete.
ModerateCVE-2016-7916SUSE bug 1010467cpe:/o:suse:suse-microos:5.0CVE-2016-7994SUSE Linux Enterprise Micro 5.0
Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands.
ModerateCVE-2016-7994SUSE bug 1003613cpe:/o:suse:suse-microos:5.0CVE-2016-7995SUSE Linux Enterprise Micro 5.0
Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of crafted buffer page select (PG) indexes.
ModerateCVE-2016-7995SUSE bug 1003612SUSE bug 1003870cpe:/o:suse:suse-microos:5.0CVE-2016-8576SUSE Linux Enterprise Micro 5.0
The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process.
ModerateCVE-2016-8576SUSE bug 1003878SUSE bug 1004016cpe:/o:suse:suse-microos:5.0CVE-2016-8577SUSE Linux Enterprise Micro 5.0
Memory leak in the v9fs_read function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors related to an I/O read operation.
ModerateCVE-2016-8577SUSE bug 1003893SUSE bug 1004021cpe:/o:suse:suse-microos:5.0CVE-2016-8578SUSE Linux Enterprise Micro 5.0
The v9fs_iov_vunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) by sending an empty string parameter to a 9P operation.
ModerateCVE-2016-8578SUSE bug 1003894SUSE bug 1004023cpe:/o:suse:suse-microos:5.0CVE-2016-8610SUSE Linux Enterprise Micro 5.0
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
ImportantCVE-2016-8610SUSE bug 1005878SUSE bug 1005879SUSE bug 1110018SUSE bug 1120592SUSE bug 1126909SUSE bug 1148697SUSE bug 982575cpe:/o:suse:suse-microos:5.0CVE-2016-8615SUSE Linux Enterprise Micro 5.0
A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.
LowCVE-2016-8615SUSE bug 1005633cpe:/o:suse:suse-microos:5.0CVE-2016-8616SUSE Linux Enterprise Micro 5.0
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.
LowCVE-2016-8616SUSE bug 1005634cpe:/o:suse:suse-microos:5.0CVE-2016-8617SUSE Linux Enterprise Micro 5.0
The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`.
LowCVE-2016-8617SUSE bug 1005635cpe:/o:suse:suse-microos:5.0CVE-2016-8618SUSE Linux Enterprise Micro 5.0
The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables.
ModerateCVE-2016-8618SUSE bug 1005637cpe:/o:suse:suse-microos:5.0CVE-2016-8619SUSE Linux Enterprise Micro 5.0
The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.
ModerateCVE-2016-8619SUSE bug 1005638cpe:/o:suse:suse-microos:5.0CVE-2016-8620SUSE Linux Enterprise Micro 5.0
The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.
LowCVE-2016-8620SUSE bug 1005640cpe:/o:suse:suse-microos:5.0CVE-2016-8621SUSE Linux Enterprise Micro 5.0
The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.
ModerateCVE-2016-8621SUSE bug 1005642cpe:/o:suse:suse-microos:5.0CVE-2016-8622SUSE Linux Enterprise Micro 5.0
The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.
LowCVE-2016-8622SUSE bug 1005643cpe:/o:suse:suse-microos:5.0CVE-2016-8623SUSE Linux Enterprise Micro 5.0
A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.
LowCVE-2016-8623SUSE bug 1005645cpe:/o:suse:suse-microos:5.0CVE-2016-8624SUSE Linux Enterprise Micro 5.0
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.
ModerateCVE-2016-8624SUSE bug 1005646cpe:/o:suse:suse-microos:5.0CVE-2016-8625SUSE Linux Enterprise Micro 5.0
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.
LowCVE-2016-8625SUSE bug 1005649cpe:/o:suse:suse-microos:5.0CVE-2016-8630SUSE Linux Enterprise Micro 5.0
The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M byte in an undefined instruction.
ModerateCVE-2016-8630SUSE bug 1009222cpe:/o:suse:suse-microos:5.0CVE-2016-8632SUSE Linux Enterprise Micro 5.0
The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability.
ModerateCVE-2016-8632SUSE bug 1008831SUSE bug 1012852SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2016-8633SUSE Linux Enterprise Micro 5.0
drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via crafted fragmented packets.
ModerateCVE-2016-8633SUSE bug 1008833cpe:/o:suse:suse-microos:5.0CVE-2016-8637SUSE Linux Enterprise Micro 5.0
A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.
LowCVE-2016-8637SUSE bug 1008340cpe:/o:suse:suse-microos:5.0CVE-2016-8645SUSE Linux Enterprise Micro 5.0
The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service (system crash) via a crafted application that makes sendto system calls, related to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c.
ModerateCVE-2016-8645SUSE bug 1009969cpe:/o:suse:suse-microos:5.0CVE-2016-8646SUSE Linux Enterprise Micro 5.0
The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data.
ModerateCVE-2016-8646SUSE bug 1010150cpe:/o:suse:suse-microos:5.0CVE-2016-8650SUSE Linux Enterprise Micro 5.0
The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service (stack memory corruption and panic) via an add_key system call for an RSA key with a zero exponent.
ImportantCVE-2016-8650SUSE bug 1011820cpe:/o:suse:suse-microos:5.0CVE-2016-8655SUSE Linux Enterprise Micro 5.0
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.
ModerateCVE-2016-8655SUSE bug 1012754SUSE bug 1012759SUSE bug 1013822SUSE bug 1052365cpe:/o:suse:suse-microos:5.0CVE-2016-8658SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.7.5 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a long SSID Information Element in a command to a Netlink socket.
ModerateCVE-2016-8658SUSE bug 1004462cpe:/o:suse:suse-microos:5.0CVE-2016-8667SUSE Linux Enterprise Micro 5.0
The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value.
ModerateCVE-2016-8667SUSE bug 1004702SUSE bug 1005004cpe:/o:suse:suse-microos:5.0CVE-2016-8668SUSE Linux Enterprise Micro 5.0
The rocker_io_writel function in hw/net/rocker/rocker.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging failure to limit DMA buffer size.
ModerateCVE-2016-8668SUSE bug 1004706cpe:/o:suse:suse-microos:5.0CVE-2016-8669SUSE Linux Enterprise Micro 5.0
The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base.
ModerateCVE-2016-8669SUSE bug 1004707SUSE bug 1005005cpe:/o:suse:suse-microos:5.0CVE-2016-8858SUSE Linux Enterprise Micro 5.0
** DISPUTED ** The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."
ModerateCVE-2016-8858SUSE bug 1005480cpe:/o:suse:suse-microos:5.0CVE-2016-8867SUSE Linux Enterprise Micro 5.0
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
ImportantCVE-2016-8867SUSE bug 1007249cpe:/o:suse:suse-microos:5.0CVE-2016-8909SUSE Linux Enterprise Micro 5.0
The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position.
LowCVE-2016-8909SUSE bug 1006536SUSE bug 1007160cpe:/o:suse:suse-microos:5.0CVE-2016-8910SUSE Linux Enterprise Micro 5.0
The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count.
LowCVE-2016-8910SUSE bug 1006538SUSE bug 1007157SUSE bug 1024178cpe:/o:suse:suse-microos:5.0CVE-2016-9015SUSE Linux Enterprise Micro 5.0
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
LowCVE-2016-9015SUSE bug 1023502SUSE bug 1024540cpe:/o:suse:suse-microos:5.0CVE-2016-9063SUSE Linux Enterprise Micro 5.0
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
CriticalCVE-2016-9063SUSE bug 1009026SUSE bug 1010424SUSE bug 1047240SUSE bug 1123115cpe:/o:suse:suse-microos:5.0CVE-2016-9082SUSE Linux Enterprise Micro 5.0
Integer overflow in the write_png function in cairo 1.14.6 allows remote attackers to cause a denial of service (invalid pointer dereference) via a large svg file.
ModerateCVE-2016-9082SUSE bug 1007255cpe:/o:suse:suse-microos:5.0CVE-2016-9101SUSE Linux Enterprise Micro 5.0
Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device.
LowCVE-2016-9101SUSE bug 1007391SUSE bug 1013668SUSE bug 1024181cpe:/o:suse:suse-microos:5.0CVE-2016-9102SUSE Linux Enterprise Micro 5.0
Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number.
ModerateCVE-2016-9102SUSE bug 1007450SUSE bug 1014256cpe:/o:suse:suse-microos:5.0CVE-2016-9103SUSE Linux Enterprise Micro 5.0
The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them.
LowCVE-2016-9103SUSE bug 1007454SUSE bug 1014259cpe:/o:suse:suse-microos:5.0CVE-2016-9104SUSE Linux Enterprise Micro 5.0
Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access.
LowCVE-2016-9104SUSE bug 1007493SUSE bug 1014297SUSE bug 1034990cpe:/o:suse:suse-microos:5.0CVE-2016-9105SUSE Linux Enterprise Micro 5.0
Memory leak in the v9fs_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors involving a reference to the source fid object.
LowCVE-2016-9105SUSE bug 1007494SUSE bug 1014279cpe:/o:suse:suse-microos:5.0CVE-2016-9106SUSE Linux Enterprise Micro 5.0
Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector.
LowCVE-2016-9106SUSE bug 1007495SUSE bug 1014299cpe:/o:suse:suse-microos:5.0CVE-2016-9178SUSE Linux Enterprise Micro 5.0
The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable, which allows local users to obtain sensitive information from kernel stack memory by triggering failure of a get_user_ex call.
LowCVE-2016-9178SUSE bug 1008650SUSE bug 1012353cpe:/o:suse:suse-microos:5.0CVE-2016-9313SUSE Linux Enterprise Micro 5.0
security/keys/big_key.c in the Linux kernel before 4.8.7 mishandles unsuccessful crypto registration in conjunction with successful key-type registration, which allows local users to cause a denial of service (NULL pointer dereference and panic) or possibly have unspecified other impact via a crafted application that uses the big_key data type.
ModerateCVE-2016-9313SUSE bug 1012356cpe:/o:suse:suse-microos:5.0CVE-2016-9377SUSE Linux Enterprise Micro 5.0
Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation.
ModerateCVE-2016-9377SUSE bug 1009108cpe:/o:suse:suse-microos:5.0CVE-2016-9378SUSE Linux Enterprise Micro 5.0
Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery.
ModerateCVE-2016-9378SUSE bug 1009108cpe:/o:suse:suse-microos:5.0CVE-2016-9379SUSE Linux Enterprise Micro 5.0
The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.
ModerateCVE-2016-9379SUSE bug 1009111cpe:/o:suse:suse-microos:5.0CVE-2016-9380SUSE Linux Enterprise Micro 5.0
The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.
ModerateCVE-2016-9380SUSE bug 1009111cpe:/o:suse:suse-microos:5.0CVE-2016-9381SUSE Linux Enterprise Micro 5.0
Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability.
ImportantCVE-2016-9381SUSE bug 1009109cpe:/o:suse:suse-microos:5.0CVE-2016-9382SUSE Linux Enterprise Micro 5.0
Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode.
ModerateCVE-2016-9382SUSE bug 1009103cpe:/o:suse:suse-microos:5.0CVE-2016-9383SUSE Linux Enterprise Micro 5.0
Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.
ModerateCVE-2016-9383SUSE bug 1009107cpe:/o:suse:suse-microos:5.0CVE-2016-9384SUSE Linux Enterprise Micro 5.0
Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table.
LowCVE-2016-9384SUSE bug 1009105cpe:/o:suse:suse-microos:5.0CVE-2016-9385SUSE Linux Enterprise Micro 5.0
The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks.
ModerateCVE-2016-9385SUSE bug 1009104cpe:/o:suse:suse-microos:5.0CVE-2016-9386SUSE Linux Enterprise Micro 5.0
The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.
ModerateCVE-2016-9386SUSE bug 1009100cpe:/o:suse:suse-microos:5.0CVE-2016-9401SUSE Linux Enterprise Micro 5.0
popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
LowCVE-2016-9401SUSE bug 1010845SUSE bug 1044328SUSE bug 1123788SUSE bug 1159416cpe:/o:suse:suse-microos:5.0CVE-2016-9555SUSE Linux Enterprise Micro 5.0
The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.
ImportantCVE-2016-9555SUSE bug 1011685SUSE bug 1012183SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2016-9577SUSE Linux Enterprise Micro 5.0
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
CriticalCVE-2016-9577SUSE bug 1023078cpe:/o:suse:suse-microos:5.0CVE-2016-9578SUSE Linux Enterprise Micro 5.0
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.
CriticalCVE-2016-9578SUSE bug 1023078SUSE bug 1023079cpe:/o:suse:suse-microos:5.0CVE-2016-9586SUSE Linux Enterprise Micro 5.0
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.
ModerateCVE-2016-9586SUSE bug 1015332cpe:/o:suse:suse-microos:5.0CVE-2016-9588SUSE Linux Enterprise Micro 5.0
arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest.
ModerateCVE-2016-9588SUSE bug 1015703SUSE bug 1017512cpe:/o:suse:suse-microos:5.0CVE-2016-9594SUSE Linux Enterprise Micro 5.0
curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable.
ImportantCVE-2016-9594SUSE bug 1016738SUSE bug 1017161SUSE bug 1042181cpe:/o:suse:suse-microos:5.0CVE-2016-9602SUSE Linux Enterprise Micro 5.0
Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.
ModerateCVE-2016-9602SUSE bug 1020427cpe:/o:suse:suse-microos:5.0CVE-2016-9604SUSE Linux Enterprise Micro 5.0
It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring.
ModerateCVE-2016-9604SUSE bug 1035576cpe:/o:suse:suse-microos:5.0CVE-2016-9637SUSE Linux Enterprise Micro 5.0
The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access.
ModerateCVE-2016-9637SUSE bug 1011652cpe:/o:suse:suse-microos:5.0CVE-2016-9639SUSE Linux Enterprise Micro 5.0
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.
LowCVE-2016-9639SUSE bug 1012398cpe:/o:suse:suse-microos:5.0CVE-2016-9756SUSE Linux Enterprise Micro 5.0
arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
ModerateCVE-2016-9756SUSE bug 1013038cpe:/o:suse:suse-microos:5.0CVE-2016-9776SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS.
LowCVE-2016-9776SUSE bug 1013285SUSE bug 1013657SUSE bug 1024182SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2016-9794SUSE Linux Enterprise Micro 5.0
Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted SNDRV_PCM_TRIGGER_START command.
ModerateCVE-2016-9794SUSE bug 1013533SUSE bug 1013543SUSE bug 1013604cpe:/o:suse:suse-microos:5.0CVE-2016-9797SUSE Linux Enterprise Micro 5.0
In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
LowCVE-2016-9797SUSE bug 1013708SUSE bug 1013712cpe:/o:suse:suse-microos:5.0CVE-2016-9798SUSE Linux Enterprise Micro 5.0
In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
LowCVE-2016-9798SUSE bug 1013708SUSE bug 1013712SUSE bug 1013732cpe:/o:suse:suse-microos:5.0CVE-2016-9800SUSE Linux Enterprise Micro 5.0
In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exists because "pin" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "pin_code_reply_cp *cp" parameter.
LowCVE-2016-9800SUSE bug 1013721cpe:/o:suse:suse-microos:5.0CVE-2016-9801SUSE Linux Enterprise Micro 5.0
In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file.
LowCVE-2016-9801SUSE bug 1013732cpe:/o:suse:suse-microos:5.0CVE-2016-9802SUSE Linux Enterprise Micro 5.0
In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
LowCVE-2016-9802SUSE bug 1013893SUSE bug 1015173cpe:/o:suse:suse-microos:5.0CVE-2016-9803SUSE Linux Enterprise Micro 5.0
In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' (which is used to read correct element from 'ev_le_meta_str' array) is overflowed.
LowCVE-2016-9803SUSE bug 1013885cpe:/o:suse:suse-microos:5.0CVE-2016-9804SUSE Linux Enterprise Micro 5.0
In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exists because "commands" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "frm->ptr" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
ModerateCVE-2016-9804SUSE bug 1013877cpe:/o:suse:suse-microos:5.0CVE-2016-9843SUSE Linux Enterprise Micro 5.0
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
ModerateCVE-2016-9843SUSE bug 1003580SUSE bug 1013882SUSE bug 1038505SUSE bug 1062104SUSE bug 1116686SUSE bug 1120866SUSE bug 1123150SUSE bug 1127473SUSE bug 1184301cpe:/o:suse:suse-microos:5.0CVE-2016-9845SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes.
LowCVE-2016-9845SUSE bug 1013767cpe:/o:suse:suse-microos:5.0CVE-2016-9846SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while updating the cursor data in update_cursor_data_virgl. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
LowCVE-2016-9846SUSE bug 1013764cpe:/o:suse:suse-microos:5.0CVE-2016-9907SUSE Linux Enterprise Micro 5.0
Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
LowCVE-2016-9907SUSE bug 1014109SUSE bug 1014490cpe:/o:suse:suse-microos:5.0CVE-2016-9908SUSE Linux Enterprise Micro 5.0
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes.
LowCVE-2016-9908SUSE bug 1014514cpe:/o:suse:suse-microos:5.0CVE-2016-9911SUSE Linux Enterprise Micro 5.0
Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
LowCVE-2016-9911SUSE bug 1014111SUSE bug 1014507cpe:/o:suse:suse-microos:5.0CVE-2016-9912SUSE Linux Enterprise Micro 5.0
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
LowCVE-2016-9912SUSE bug 1014112cpe:/o:suse:suse-microos:5.0CVE-2016-9913SUSE Linux Enterprise Micro 5.0
Memory leak in the v9fs_device_unrealize_common function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) via vectors involving the order of resource cleanup.
LowCVE-2016-9913SUSE bug 1014110SUSE bug 1014311cpe:/o:suse:suse-microos:5.0CVE-2016-9917SUSE Linux Enterprise Micro 5.0
In BlueZ 5.42, a buffer overflow was observed in "read_n" function in "tools/hcidump.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
ModerateCVE-2016-9917SUSE bug 1015171cpe:/o:suse:suse-microos:5.0CVE-2016-9918SUSE Linux Enterprise Micro 5.0
In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
ModerateCVE-2016-9918SUSE bug 1013893SUSE bug 1015173cpe:/o:suse:suse-microos:5.0CVE-2016-9921SUSE Linux Enterprise Micro 5.0
Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host, resulting in DoS.
LowCVE-2016-9921SUSE bug 1014702SUSE bug 1015169SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2016-9922SUSE Linux Enterprise Micro 5.0
The cirrus_do_copy function in hw/display/cirrus_vga.c in QEMU (aka Quick Emulator), when cirrus graphics mode is VGA, allows local guest OS privileged users to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving blit pitch values.
LowCVE-2016-9922SUSE bug 1014702SUSE bug 1015169SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2016-9923SUSE Linux Enterprise Micro 5.0
Quick Emulator (Qemu) built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS.
LowCVE-2016-9923SUSE bug 1014703SUSE bug 1015145SUSE bug 1015148SUSE bug 1015154cpe:/o:suse:suse-microos:5.0CVE-2016-9932SUSE Linux Enterprise Micro 5.0
CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix.
LowCVE-2016-9932SUSE bug 1012651SUSE bug 1016340cpe:/o:suse:suse-microos:5.0CVE-2016-9962SUSE Linux Enterprise Micro 5.0
RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.
ModerateCVE-2016-9962SUSE bug 1012568SUSE bug 1173425cpe:/o:suse:suse-microos:5.0CVE-2017-0379SUSE Linux Enterprise Micro 5.0
Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.
CriticalCVE-2017-0379SUSE bug 1055837cpe:/o:suse:suse-microos:5.0CVE-2017-0381SUSE Linux Enterprise Micro 5.0
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.
ModerateCVE-2017-0381SUSE bug 1020102cpe:/o:suse:suse-microos:5.0CVE-2017-0386SUSE Linux Enterprise Micro 5.0
An elevation of privilege vulnerability in the libnl library could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32255299.
ModerateCVE-2017-0386SUSE bug 1020123cpe:/o:suse:suse-microos:5.0CVE-2017-0663SUSE Linux Enterprise Micro 5.0
A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.
ImportantCVE-2017-0663SUSE bug 1044337SUSE bug 1123919cpe:/o:suse:suse-microos:5.0CVE-2017-1000099SUSE Linux Enterprise Micro 5.0
When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the heap and if it turned out to not contain any zero byte, it would continue and display the data following that buffer in memory.
ModerateCVE-2017-1000099SUSE bug 1051645SUSE bug 1053919cpe:/o:suse:suse-microos:5.0CVE-2017-1000100SUSE Linux Enterprise Micro 5.0
When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.
LowCVE-2017-1000100SUSE bug 1051644cpe:/o:suse:suse-microos:5.0CVE-2017-1000101SUSE Linux Enterprise Micro 5.0
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.
ModerateCVE-2017-1000101SUSE bug 1051643cpe:/o:suse:suse-microos:5.0CVE-2017-1000249SUSE Linux Enterprise Micro 5.0
An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e5327495793 (Aug 2017).
ModerateCVE-2017-1000249SUSE bug 1056838cpe:/o:suse:suse-microos:5.0CVE-2017-1000250SUSE Linux Enterprise Micro 5.0
All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.
LowCVE-2017-1000250SUSE bug 1057342cpe:/o:suse:suse-microos:5.0CVE-2017-1000251SUSE Linux Enterprise Micro 5.0
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.
ImportantCVE-2017-1000251SUSE bug 1057389SUSE bug 1057950SUSE bug 1070535SUSE bug 1072162SUSE bug 1120758cpe:/o:suse:suse-microos:5.0CVE-2017-1000254SUSE Linux Enterprise Micro 5.0
libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.
LowCVE-2017-1000254SUSE bug 1061876cpe:/o:suse:suse-microos:5.0CVE-2017-1000256SUSE Linux Enterprise Micro 5.0
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.
ImportantCVE-2017-1000256SUSE bug 1062563cpe:/o:suse:suse-microos:5.0CVE-2017-1000257SUSE Linux Enterprise Micro 5.0
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
ModerateCVE-2017-1000257SUSE bug 1063824cpe:/o:suse:suse-microos:5.0CVE-2017-1000366SUSE Linux Enterprise Micro 5.0
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.
ImportantCVE-2017-1000366SUSE bug 1037551SUSE bug 1039357SUSE bug 1071319SUSE bug 1123874cpe:/o:suse:suse-microos:5.0CVE-2017-1000367SUSE Linux Enterprise Micro 5.0
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
ImportantCVE-2017-1000367SUSE bug 1007501SUSE bug 1039361SUSE bug 1042146SUSE bug 1077345cpe:/o:suse:suse-microos:5.0CVE-2017-1000368SUSE Linux Enterprise Micro 5.0
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
ImportantCVE-2017-1000368SUSE bug 1039361SUSE bug 1042146SUSE bug 1045986cpe:/o:suse:suse-microos:5.0CVE-2017-1000370SUSE Linux Enterprise Micro 5.0
The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed with 1GB of arguments or environmental strings then the stack occupies the address 0x80000000 and the PIE binary is mapped above 0x40000000 nullifying the protection of the offset2lib patch. This affects Linux Kernel version 4.11.5 and earlier. This is a different issue than CVE-2017-1000371. This issue appears to be limited to i386 based systems.
LowCVE-2017-1000370SUSE bug 1037551SUSE bug 1039346SUSE bug 1039349SUSE bug 1039354cpe:/o:suse:suse-microos:5.0CVE-2017-1000371SUSE Linux Enterprise Micro 5.0
The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems.
LowCVE-2017-1000371SUSE bug 1037551SUSE bug 1039346SUSE bug 1039349SUSE bug 1039354cpe:/o:suse:suse-microos:5.0CVE-2017-1000380SUSE Linux Enterprise Micro 5.0
sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.
LowCVE-2017-1000380SUSE bug 1044125cpe:/o:suse:suse-microos:5.0CVE-2017-1000382SUSE Linux Enterprise Micro 5.0
VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.
LowCVE-2017-1000382SUSE bug 1065958SUSE bug 1070955cpe:/o:suse:suse-microos:5.0CVE-2017-1000408SUSE Linux Enterprise Micro 5.0
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
ImportantCVE-2017-1000408SUSE bug 1039357SUSE bug 1071319cpe:/o:suse:suse-microos:5.0CVE-2017-1000409SUSE Linux Enterprise Micro 5.0
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
ImportantCVE-2017-1000409SUSE bug 1071319cpe:/o:suse:suse-microos:5.0CVE-2017-10661SUSE Linux Enterprise Micro 5.0
Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing.
ImportantCVE-2017-10661SUSE bug 1053152SUSE bug 1053153SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-10664SUSE Linux Enterprise Micro 5.0
qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.
ModerateCVE-2017-10664SUSE bug 1046636SUSE bug 1046637SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2017-10806SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.
ModerateCVE-2017-10806SUSE bug 1047674SUSE bug 1047675cpe:/o:suse:suse-microos:5.0CVE-2017-10911SUSE Linux Enterprise Micro 5.0
The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka XSA-216.
ModerateCVE-2017-10911SUSE bug 1042863SUSE bug 1043330SUSE bug 1057378cpe:/o:suse:suse-microos:5.0CVE-2017-11176SUSE Linux Enterprise Micro 5.0
The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.
ImportantCVE-2017-11176SUSE bug 1048275SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-11334SUSE Linux Enterprise Micro 5.0
The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area.
ModerateCVE-2017-11334SUSE bug 1048902SUSE bug 1048920cpe:/o:suse:suse-microos:5.0CVE-2017-11368SUSE Linux Enterprise Micro 5.0
In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.
ModerateCVE-2017-11368SUSE bug 1049819cpe:/o:suse:suse-microos:5.0CVE-2017-11423SUSE Linux Enterprise Micro 5.0
The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.
ModerateCVE-2017-11423SUSE bug 1049423SUSE bug 1083915cpe:/o:suse:suse-microos:5.0CVE-2017-11434SUSE Linux Enterprise Micro 5.0
The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.
ImportantCVE-2017-11434SUSE bug 1049381SUSE bug 1049578SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2017-11462SUSE Linux Enterprise Micro 5.0
Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.
ModerateCVE-2017-11462SUSE bug 1056995SUSE bug 1122468cpe:/o:suse:suse-microos:5.0CVE-2017-11472SUSE Linux Enterprise Micro 5.0
The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.
LowCVE-2017-11472SUSE bug 1049580SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2017-11600SUSE Linux Enterprise Micro 5.0
net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.
ImportantCVE-2017-11600SUSE bug 1050231SUSE bug 1096564SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-11695SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.
ImportantCVE-2017-11695SUSE bug 1053418SUSE bug 1053419SUSE bug 1053420SUSE bug 1053422cpe:/o:suse:suse-microos:5.0CVE-2017-11696SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.
ModerateCVE-2017-11696SUSE bug 1053418SUSE bug 1053419SUSE bug 1053420SUSE bug 1053422cpe:/o:suse:suse-microos:5.0CVE-2017-11698SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.
ModerateCVE-2017-11698SUSE bug 1053418SUSE bug 1053419SUSE bug 1053420SUSE bug 1053422cpe:/o:suse:suse-microos:5.0CVE-2017-12132SUSE Linux Enterprise Micro 5.0
The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation.
ModerateCVE-2017-12132SUSE bug 1051791SUSE bug 1123874cpe:/o:suse:suse-microos:5.0CVE-2017-12133SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path.
LowCVE-2017-12133SUSE bug 1081556SUSE bug 1123874SUSE bug 980854cpe:/o:suse:suse-microos:5.0CVE-2017-12135SUSE Linux Enterprise Micro 5.0
Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain privileges via vectors involving transitive grants.
ImportantCVE-2017-12135SUSE bug 1051787SUSE bug 1169392SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2017-12136SUSE Linux Enterprise Micro 5.0
Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service (free list corruption and host crash) or gain privileges on the host via vectors involving maptrack free list handling.
ImportantCVE-2017-12136SUSE bug 1051789cpe:/o:suse:suse-microos:5.0CVE-2017-12137SUSE Linux Enterprise Micro 5.0
arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map_grant_ref.
ImportantCVE-2017-12137SUSE bug 1051788SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2017-12153SUSE Linux Enterprise Micro 5.0
A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This function does not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash.
ModerateCVE-2017-12153SUSE bug 1058410SUSE bug 1058624cpe:/o:suse:suse-microos:5.0CVE-2017-12652SUSE Linux Enterprise Micro 5.0
libpng before 1.6.32 does not properly check the length of chunks against the user limit.
LowCVE-2017-12652SUSE bug 1141493cpe:/o:suse:suse-microos:5.0CVE-2017-12791SUSE Linux Enterprise Micro 5.0
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.
ModerateCVE-2017-12791SUSE bug 1053955SUSE bug 1062462cpe:/o:suse:suse-microos:5.0CVE-2017-12814SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute arbitrary code via a long environment variable.
CriticalCVE-2017-12814SUSE bug 1057727cpe:/o:suse:suse-microos:5.0CVE-2017-12837SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\N{}' escape and the case-insensitive modifier.
LowCVE-2017-12837SUSE bug 1057724cpe:/o:suse:suse-microos:5.0CVE-2017-12883SUSE Linux Enterprise Micro 5.0
Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape.
ModerateCVE-2017-12883SUSE bug 1057721cpe:/o:suse:suse-microos:5.0CVE-2017-13077SUSE Linux Enterprise Micro 5.0
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
ImportantCVE-2017-13077SUSE bug 1056061SUSE bug 1063479SUSE bug 1063963SUSE bug 1179588cpe:/o:suse:suse-microos:5.0CVE-2017-13078SUSE Linux Enterprise Micro 5.0
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.
ImportantCVE-2017-13078SUSE bug 1056061SUSE bug 1063479SUSE bug 1063667SUSE bug 1179588cpe:/o:suse:suse-microos:5.0CVE-2017-13079SUSE Linux Enterprise Micro 5.0
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.
ImportantCVE-2017-13079SUSE bug 1056061SUSE bug 1063479SUSE bug 1179588cpe:/o:suse:suse-microos:5.0CVE-2017-13080SUSE Linux Enterprise Micro 5.0
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.
ImportantCVE-2017-13080SUSE bug 1056061SUSE bug 1063479SUSE bug 1063667SUSE bug 1063671SUSE bug 1066295SUSE bug 1105108SUSE bug 1178872SUSE bug 1179588cpe:/o:suse:suse-microos:5.0CVE-2017-13081SUSE Linux Enterprise Micro 5.0
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.
ImportantCVE-2017-13081SUSE bug 1056061SUSE bug 1063479SUSE bug 1066295SUSE bug 1105108SUSE bug 1179588cpe:/o:suse:suse-microos:5.0CVE-2017-13082SUSE Linux Enterprise Micro 5.0
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
ImportantCVE-2017-13082SUSE bug 1056061SUSE bug 1063479SUSE bug 1179588cpe:/o:suse:suse-microos:5.0CVE-2017-13086SUSE Linux Enterprise Micro 5.0
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
ImportantCVE-2017-13086SUSE bug 1056061SUSE bug 1063479SUSE bug 1179588cpe:/o:suse:suse-microos:5.0CVE-2017-13087SUSE Linux Enterprise Micro 5.0
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
ImportantCVE-2017-13087SUSE bug 1056061SUSE bug 1063479SUSE bug 1179588cpe:/o:suse:suse-microos:5.0CVE-2017-13088SUSE Linux Enterprise Micro 5.0
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
ImportantCVE-2017-13088SUSE bug 1056061SUSE bug 1063479SUSE bug 1179588cpe:/o:suse:suse-microos:5.0CVE-2017-13168SUSE Linux Enterprise Micro 5.0
An elevation of privilege vulnerability in the kernel scsi driver. Product: Android. Versions: Android kernel. Android ID A-65023233.
ModerateCVE-2017-13168SUSE bug 1072831cpe:/o:suse:suse-microos:5.0CVE-2017-13215SUSE Linux Enterprise Micro 5.0
A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Android ID: A-64386293. References: Upstream kernel.
ModerateCVE-2017-13215SUSE bug 1075908SUSE bug 1091815cpe:/o:suse:suse-microos:5.0CVE-2017-13220SUSE Linux Enterprise Micro 5.0
An elevation of privilege vulnerability in the Upstream kernel bluez. Product: Android. Versions: Android kernel. Android ID: A-63527053.
ModerateCVE-2017-13220SUSE bug 1076537cpe:/o:suse:suse-microos:5.0CVE-2017-13672SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update.
LowCVE-2017-13672SUSE bug 1056334SUSE bug 1056336SUSE bug 1084604cpe:/o:suse:suse-microos:5.0CVE-2017-13673SUSE Linux Enterprise Micro 5.0
The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty function.
LowCVE-2017-13673SUSE bug 1056386SUSE bug 1056387SUSE bug 1084604cpe:/o:suse:suse-microos:5.0CVE-2017-13693SUSE Linux Enterprise Micro 5.0
The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.
LowCVE-2017-13693SUSE bug 1055713cpe:/o:suse:suse-microos:5.0CVE-2017-13694SUSE Linux Enterprise Micro 5.0
The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and node_ext caches and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.
LowCVE-2017-13694SUSE bug 1055705cpe:/o:suse:suse-microos:5.0CVE-2017-13711SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets.
LowCVE-2017-13711SUSE bug 1056291cpe:/o:suse:suse-microos:5.0CVE-2017-14051SUSE Linux Enterprise Micro 5.0
An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access.
ModerateCVE-2017-14051SUSE bug 1056588cpe:/o:suse:suse-microos:5.0CVE-2017-14062SUSE Linux Enterprise Micro 5.0
Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
ModerateCVE-2017-14062SUSE bug 1056450SUSE bug 1087709SUSE bug 1118435SUSE bug 1123123SUSE bug 1173590cpe:/o:suse:suse-microos:5.0CVE-2017-14106SUSE Linux Enterprise Micro 5.0
The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path.
ModerateCVE-2017-14106SUSE bug 1056982cpe:/o:suse:suse-microos:5.0CVE-2017-14140SUSE Linux Enterprise Micro 5.0
The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR.
LowCVE-2017-14140SUSE bug 1057179cpe:/o:suse:suse-microos:5.0CVE-2017-14160SUSE Linux Enterprise Micro 5.0
The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.
ModerateCVE-2017-14160SUSE bug 1059812SUSE bug 1091072cpe:/o:suse:suse-microos:5.0CVE-2017-14167SUSE Linux Enterprise Micro 5.0
Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write.
LowCVE-2017-14167SUSE bug 1057585cpe:/o:suse:suse-microos:5.0CVE-2017-14316SUSE Linux Enterprise Micro 5.0
A parameter verification issue was discovered in Xen through 4.9.x. The function `alloc_heap_pages` allows callers to specify the first NUMA node that should be used for allocations through the `memflags` parameter; the node is extracted using the `MEMF_get_node` macro. While the function checks to see if the special constant `NUMA_NO_NODE` is specified, it otherwise does not handle the case where `node >= MAX_NUMNODES`. This allows an out-of-bounds access to an internal array.
ImportantCVE-2017-14316SUSE bug 1056278SUSE bug 1072198SUSE bug 1072223cpe:/o:suse:suse-microos:5.0CVE-2017-14489SUSE Linux Enterprise Micro 5.0
The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of service (panic) by leveraging incorrect length validation.
ModerateCVE-2017-14489SUSE bug 1059051cpe:/o:suse:suse-microos:5.0CVE-2017-14497SUSE Linux Enterprise Micro 5.0
The tpacket_rcv function in net/packet/af_packet.c in the Linux kernel before 4.13 mishandles vnet headers, which might allow local users to cause a denial of service (buffer overflow, and disk and memory corruption) or possibly have unspecified other impact via crafted system calls.
CriticalCVE-2017-14497SUSE bug 1059058cpe:/o:suse:suse-microos:5.0CVE-2017-14632SUSE Linux Enterprise Micro 5.0
Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184.
ImportantCVE-2017-14632SUSE bug 1059809cpe:/o:suse:suse-microos:5.0CVE-2017-14633SUSE Linux Enterprise Micro 5.0
In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis().
ModerateCVE-2017-14633SUSE bug 1059811SUSE bug 1081833cpe:/o:suse:suse-microos:5.0CVE-2017-14695SUSE Linux Enterprise Micro 5.0
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.
ModerateCVE-2017-14695SUSE bug 1053955SUSE bug 1062462cpe:/o:suse:suse-microos:5.0CVE-2017-14696SUSE Linux Enterprise Micro 5.0
SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.
ModerateCVE-2017-14696SUSE bug 1053955SUSE bug 1062464cpe:/o:suse:suse-microos:5.0CVE-2017-14992SUSE Linux Enterprise Micro 5.0
Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.
ModerateCVE-2017-14992SUSE bug 1066210cpe:/o:suse:suse-microos:5.0CVE-2017-15038SUSE Linux Enterprise Micro 5.0
Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes.
LowCVE-2017-15038SUSE bug 1062069cpe:/o:suse:suse-microos:5.0CVE-2017-15102SUSE Linux Enterprise Micro 5.0
The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.
ModerateCVE-2017-15102SUSE bug 1066705cpe:/o:suse:suse-microos:5.0CVE-2017-15115SUSE Linux Enterprise Micro 5.0
The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.
ModerateCVE-2017-15115SUSE bug 1068671SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-15116SUSE Linux Enterprise Micro 5.0
The rngapi_reset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service (NULL pointer dereference).
LowCVE-2017-15116SUSE bug 1070613cpe:/o:suse:suse-microos:5.0CVE-2017-15118SUSE Linux Enterprise Micro 5.0
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
CriticalCVE-2017-15118SUSE bug 1070147cpe:/o:suse:suse-microos:5.0CVE-2017-15119SUSE Linux Enterprise Micro 5.0
The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. It could occur if a client sent large option requests, making the server waste CPU time on reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other requests, resulting in DoS.
LowCVE-2017-15119SUSE bug 1070144cpe:/o:suse:suse-microos:5.0CVE-2017-15232SUSE Linux Enterprise Micro 5.0
libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.
ModerateCVE-2017-15232SUSE bug 1062937cpe:/o:suse:suse-microos:5.0CVE-2017-15265SUSE Linux Enterprise Micro 5.0
Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c.
ModerateCVE-2017-15265SUSE bug 1062520SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-15268SUSE Linux Enterprise Micro 5.0
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.
ModerateCVE-2017-15268SUSE bug 1062942cpe:/o:suse:suse-microos:5.0CVE-2017-15274SUSE Linux Enterprise Micro 5.0
security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length value, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192.
ModerateCVE-2017-15274SUSE bug 1045327SUSE bug 1062471cpe:/o:suse:suse-microos:5.0CVE-2017-15289SUSE Linux Enterprise Micro 5.0
The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation.
ModerateCVE-2017-15289SUSE bug 1063122SUSE bug 1063123SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2017-15649SUSE Linux Enterprise Micro 5.0
net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346.
ImportantCVE-2017-15649SUSE bug 1064388SUSE bug 1064392SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2017-15670SUSE Linux Enterprise Micro 5.0
The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string.
ImportantCVE-2017-15670SUSE bug 1064583SUSE bug 1110160SUSE bug 1123874cpe:/o:suse:suse-microos:5.0CVE-2017-15671SUSE Linux Enterprise Micro 5.0
The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak).
ImportantCVE-2017-15671SUSE bug 1064569SUSE bug 1123874cpe:/o:suse:suse-microos:5.0CVE-2017-15804SUSE Linux Enterprise Micro 5.0
The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator.
ModerateCVE-2017-15804SUSE bug 1064580SUSE bug 1110160SUSE bug 1123874cpe:/o:suse:suse-microos:5.0CVE-2017-15868SUSE Linux Enterprise Micro 5.0
The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows local users to gain privileges via a crafted application.
ImportantCVE-2017-15868SUSE bug 1071470SUSE bug 1071471SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-15908SUSE Linux Enterprise Micro 5.0
In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service and cause a DoS of the affected service.
ModerateCVE-2017-15908SUSE bug 1065276cpe:/o:suse:suse-microos:5.0CVE-2017-16528SUSE Linux Enterprise Micro 5.0
sound/core/seq_device.c in the Linux kernel before 4.13.4 allows local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device.
ModerateCVE-2017-16528SUSE bug 1066629SUSE bug 1146519cpe:/o:suse:suse-microos:5.0CVE-2017-16530SUSE Linux Enterprise Micro 5.0
The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to drivers/usb/storage/uas-detect.h and drivers/usb/storage/uas.c.
ModerateCVE-2017-16530SUSE bug 1066668SUSE bug 1146519cpe:/o:suse:suse-microos:5.0CVE-2017-16532SUSE Linux Enterprise Micro 5.0
The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
ModerateCVE-2017-16532SUSE bug 1066673SUSE bug 1087082SUSE bug 1146519cpe:/o:suse:suse-microos:5.0CVE-2017-16536SUSE Linux Enterprise Micro 5.0
The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
ModerateCVE-2017-16536SUSE bug 1066606SUSE bug 1087082SUSE bug 1146519cpe:/o:suse:suse-microos:5.0CVE-2017-16537SUSE Linux Enterprise Micro 5.0
The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
ModerateCVE-2017-16537SUSE bug 1066573SUSE bug 1087082SUSE bug 1146519cpe:/o:suse:suse-microos:5.0CVE-2017-16539SUSE Linux Enterprise Micro 5.0
The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.
ModerateCVE-2017-16539SUSE bug 1066801cpe:/o:suse:suse-microos:5.0CVE-2017-16548SUSE Linux Enterprise Micro 5.0
The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.
LowCVE-2017-16548SUSE bug 1066644cpe:/o:suse:suse-microos:5.0CVE-2017-16646SUSE Linux Enterprise Micro 5.0
drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device.
ModerateCVE-2017-16646SUSE bug 1067105SUSE bug 1146519cpe:/o:suse:suse-microos:5.0CVE-2017-16648SUSE Linux Enterprise Micro 5.0
The dvb_frontend_free function in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device. NOTE: the function was later renamed __dvb_frontend_free.
ModerateCVE-2017-16648SUSE bug 1067087SUSE bug 1087082SUSE bug 1146519cpe:/o:suse:suse-microos:5.0CVE-2017-16845SUSE Linux Enterprise Micro 5.0
hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access.
LowCVE-2017-16845SUSE bug 1068613cpe:/o:suse:suse-microos:5.0CVE-2017-16997SUSE Linux Enterprise Micro 5.0
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
ImportantCVE-2017-16997SUSE bug 1073231cpe:/o:suse:suse-microos:5.0CVE-2017-17053SUSE Linux Enterprise Micro 5.0
The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. This vulnerability only affected kernels built with CONFIG_MODIFY_LDT_SYSCALL=y.
ModerateCVE-2017-17053SUSE bug 1070264SUSE bug 1096679cpe:/o:suse:suse-microos:5.0CVE-2017-17087SUSE Linux Enterprise Micro 5.0
fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.
LowCVE-2017-17087SUSE bug 1065958SUSE bug 1070955cpe:/o:suse:suse-microos:5.0CVE-2017-17426SUSE Linux Enterprise Micro 5.0
The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.
ImportantCVE-2017-17426SUSE bug 1071479cpe:/o:suse:suse-microos:5.0CVE-2017-17450SUSE Linux Enterprise Micro 5.0
net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces.
ModerateCVE-2017-17450SUSE bug 1071695SUSE bug 1074033SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-17558SUSE Linux Enterprise Micro 5.0
The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.
ModerateCVE-2017-17558SUSE bug 1072561SUSE bug 1087082SUSE bug 1146519cpe:/o:suse:suse-microos:5.0CVE-2017-17740SUSE Linux Enterprise Micro 5.0
contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.
ModerateCVE-2017-17740SUSE bug 1073313cpe:/o:suse:suse-microos:5.0CVE-2017-17742SUSE Linux Enterprise Micro 5.0
Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.
ModerateCVE-2017-17742SUSE bug 1087434SUSE bug 1136906SUSE bug 1152992cpe:/o:suse:suse-microos:5.0CVE-2017-17806SUSE Linux Enterprise Micro 5.0
The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.
LowCVE-2017-17806SUSE bug 1073874SUSE bug 1087082SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-17833SUSE Linux Enterprise Micro 5.0
OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.
ImportantCVE-2017-17833SUSE bug 1090638SUSE bug 1099519SUSE bug 1126909cpe:/o:suse:suse-microos:5.0CVE-2017-17840SUSE Linux Enterprise Micro 5.0
An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths, which (due to lack of checking) can lead to buffer overflows, and result in aborts (with overflow checking enabled) or code execution. The process_iscsid_broadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the payload length before a write operation.
ImportantCVE-2017-17840SUSE bug 1072312cpe:/o:suse:suse-microos:5.0CVE-2017-18078SUSE Linux Enterprise Micro 5.0
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.
ImportantCVE-2017-18078SUSE bug 1077925cpe:/o:suse:suse-microos:5.0CVE-2017-18207SUSE Linux Enterprise Micro 5.0
** DISPUTED ** The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of exceptions."
ModerateCVE-2017-18207SUSE bug 1083507cpe:/o:suse:suse-microos:5.0CVE-2017-18222SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 4.12, Hisilicon Network Subsystem (HNS) does not consider the ETH_SS_PRIV_FLAGS case when retrieving sset_count data, which allows local users to cause a denial of service (buffer overflow and memory corruption) or possibly have unspecified other impact, as demonstrated by incompatibility between hns_get_sset_count and ethtool_get_strings.
ImportantCVE-2017-18222SUSE bug 1084529cpe:/o:suse:suse-microos:5.0CVE-2017-18249SUSE Linux Enterprise Micro 5.0
The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads.
ModerateCVE-2017-18249SUSE bug 1087036cpe:/o:suse:suse-microos:5.0CVE-2017-18255SUSE Linux Enterprise Micro 5.0
The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow) or possibly have unspecified other impact via a large value, as demonstrated by an incorrect sample-rate calculation.
ModerateCVE-2017-18255SUSE bug 1087082SUSE bug 1087813cpe:/o:suse:suse-microos:5.0CVE-2017-18258SUSE Linux Enterprise Micro 5.0
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
LowCVE-2017-18258SUSE bug 1088279SUSE bug 1088601SUSE bug 1105166cpe:/o:suse:suse-microos:5.0CVE-2017-18261SUSE Linux Enterprise Micro 5.0
The arch_timer_reg_read_stable macro in arch/arm64/include/asm/arch_timer.h in the Linux kernel before 4.13 allows local users to cause a denial of service (infinite recursion) by writing to a file under /sys/kernel/debug in certain circumstances, as demonstrated by a scenario involving debugfs, ftrace, PREEMPT_TRACER, and FUNCTION_GRAPH_TRACER.
ModerateCVE-2017-18261SUSE bug 1090225cpe:/o:suse:suse-microos:5.0CVE-2017-18269SUSE Linux Enterprise Micro 5.0
An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping memory check if the source memory range spans the middle of the address space, resulting in corrupt data being produced by the copy operation. This may disclose information to context-dependent attackers, or result in a denial of service, or, possibly, code execution.
ModerateCVE-2017-18269SUSE bug 1094150SUSE bug 1118435cpe:/o:suse:suse-microos:5.0CVE-2017-18270SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands, setting unwanted defaults or causing a denial of service.
ModerateCVE-2017-18270SUSE bug 1065999SUSE bug 1087082SUSE bug 1094186SUSE bug 1174993cpe:/o:suse:suse-microos:5.0CVE-2017-18342SUSE Linux Enterprise Micro 5.0
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
ImportantCVE-2017-18342SUSE bug 1099308SUSE bug 1164453cpe:/o:suse:suse-microos:5.0CVE-2017-18552SUSE Linux Enterprise Micro 5.0
An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.
ImportantCVE-2017-18552SUSE bug 1146295cpe:/o:suse:suse-microos:5.0CVE-2017-2584SUSE Linux Enterprise Micro 5.0
arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt.
ModerateCVE-2017-2584SUSE bug 1019851SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2017-2615SUSE Linux Enterprise Micro 5.0
Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.
ModerateCVE-2017-2615SUSE bug 1023004SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2017-2616SUSE Linux Enterprise Micro 5.0
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
ImportantCVE-2017-2616SUSE bug 1023041SUSE bug 1123789cpe:/o:suse:suse-microos:5.0CVE-2017-2620SUSE Linux Enterprise Micro 5.0
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.
ModerateCVE-2017-2620SUSE bug 1024834SUSE bug 1024972SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2017-2629SUSE Linux Enterprise Micro 5.0
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
ModerateCVE-2017-2629SUSE bug 1025379SUSE bug 1042181cpe:/o:suse:suse-microos:5.0CVE-2017-2630SUSE Linux Enterprise Micro 5.0
A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
ModerateCVE-2017-2630SUSE bug 1025396cpe:/o:suse:suse-microos:5.0CVE-2017-2633SUSE Linux Enterprise Micro 5.0
An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.
LowCVE-2017-2633SUSE bug 1026612SUSE bug 1026636SUSE bug 1074701cpe:/o:suse:suse-microos:5.0CVE-2017-2635SUSE Linux Enterprise Micro 5.0
A NULL pointer deference flaw was found in the way libvirt from 2.5.0 to 3.0.0 handled empty drives. A remote authenticated attacker could use this flaw to crash libvirtd daemon resulting in denial of service.
LowCVE-2017-2635SUSE bug 1027075cpe:/o:suse:suse-microos:5.0CVE-2017-2647SUSE Linux Enterprise Micro 5.0
The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c.
ImportantCVE-2017-2647SUSE bug 1030593SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-2671SUSE Linux Enterprise Micro 5.0
The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call.
ImportantCVE-2017-2671SUSE bug 1027179SUSE bug 1031003SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2017-3731SUSE Linux Enterprise Micro 5.0
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.
ModerateCVE-2017-3731SUSE bug 1021641SUSE bug 1022085SUSE bug 1064118SUSE bug 1064119cpe:/o:suse:suse-microos:5.0CVE-2017-3732SUSE Linux Enterprise Micro 5.0
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem.
LowCVE-2017-3732SUSE bug 1021641SUSE bug 1022086SUSE bug 1049418SUSE bug 1049421SUSE bug 1049422SUSE bug 1066242SUSE bug 1071906SUSE bug 957814cpe:/o:suse:suse-microos:5.0CVE-2017-3735SUSE Linux Enterprise Micro 5.0
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
ModerateCVE-2017-3735SUSE bug 1056058cpe:/o:suse:suse-microos:5.0CVE-2017-3736SUSE Linux Enterprise Micro 5.0
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.
ModerateCVE-2017-3736SUSE bug 1066242SUSE bug 1071906SUSE bug 1076369SUSE bug 957814cpe:/o:suse:suse-microos:5.0CVE-2017-3738SUSE Linux Enterprise Micro 5.0
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository.
LowCVE-2017-3738SUSE bug 1071906SUSE bug 1097757cpe:/o:suse:suse-microos:5.0CVE-2017-5029SUSE Linux Enterprise Micro 5.0
The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
LowCVE-2017-5029SUSE bug 1028848SUSE bug 1028875SUSE bug 1035905SUSE bug 1123130cpe:/o:suse:suse-microos:5.0CVE-2017-5200SUSE Linux Enterprise Micro 5.0
Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.
ModerateCVE-2017-5200SUSE bug 1011800cpe:/o:suse:suse-microos:5.0CVE-2017-5436SUSE Linux Enterprise Micro 5.0
An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
ModerateCVE-2017-5436SUSE bug 1035082SUSE bug 1035204cpe:/o:suse:suse-microos:5.0CVE-2017-5525SUSE Linux Enterprise Micro 5.0
Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
LowCVE-2017-5525SUSE bug 1020491cpe:/o:suse:suse-microos:5.0CVE-2017-5526SUSE Linux Enterprise Micro 5.0
Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
LowCVE-2017-5526SUSE bug 1020589SUSE bug 1059777SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2017-5549SUSE Linux Enterprise Micro 5.0
The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which allows local users to obtain sensitive information by reading the log.
LowCVE-2017-5549SUSE bug 1021256SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2017-5551SUSE Linux Enterprise Micro 5.0
The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7097.
LowCVE-2017-5551SUSE bug 1021258SUSE bug 995968cpe:/o:suse:suse-microos:5.0CVE-2017-5552SUSE Linux Enterprise Micro 5.0
Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
LowCVE-2017-5552SUSE bug 1021195cpe:/o:suse:suse-microos:5.0CVE-2017-5578SUSE Linux Enterprise Micro 5.0
Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
LowCVE-2017-5578SUSE bug 1021481cpe:/o:suse:suse-microos:5.0CVE-2017-5579SUSE Linux Enterprise Micro 5.0
Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
LowCVE-2017-5579SUSE bug 1021741SUSE bug 1022627cpe:/o:suse:suse-microos:5.0CVE-2017-5667SUSE Linux Enterprise Micro 5.0
The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds heap access and crash) or execute arbitrary code on the QEMU host via vectors involving the data transfer length.
ModerateCVE-2017-5667SUSE bug 1022541cpe:/o:suse:suse-microos:5.0CVE-2017-5669SUSE Linux Enterprise Micro 5.0
The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.
ModerateCVE-2017-5669SUSE bug 1026914SUSE bug 1102390SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-5715SUSE Linux Enterprise Micro 5.0
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
ImportantCVE-2017-5715SUSE bug 1068032SUSE bug 1074562SUSE bug 1074578SUSE bug 1074701SUSE bug 1074741SUSE bug 1074919SUSE bug 1075006SUSE bug 1075007SUSE bug 1075262SUSE bug 1075419SUSE bug 1076115SUSE bug 1076372SUSE bug 1076606SUSE bug 1078353SUSE bug 1080039SUSE bug 1087887SUSE bug 1087939SUSE bug 1088147SUSE bug 1089055SUSE bug 1091815SUSE bug 1095735SUSE bug 1102517SUSE bug 1105108SUSE bug 1126516SUSE bug 1173489SUSE bug 1178658SUSE bug 1201457SUSE bug 1201877SUSE bug 1203236cpe:/o:suse:suse-microos:5.0CVE-2017-5753SUSE Linux Enterprise Micro 5.0
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
ImportantCVE-2017-5753SUSE bug 1068032SUSE bug 1074562SUSE bug 1074578SUSE bug 1074701SUSE bug 1075006SUSE bug 1075419SUSE bug 1075748SUSE bug 1080039SUSE bug 1087084SUSE bug 1087939SUSE bug 1089055SUSE bug 1136865SUSE bug 1178658SUSE bug 1201877SUSE bug 1209547cpe:/o:suse:suse-microos:5.0CVE-2017-5754SUSE Linux Enterprise Micro 5.0
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
ImportantCVE-2017-5754SUSE bug 1068032SUSE bug 1074562SUSE bug 1074578SUSE bug 1074701SUSE bug 1075006SUSE bug 1075008SUSE bug 1087939SUSE bug 1089055SUSE bug 1115045SUSE bug 1136865SUSE bug 1178658SUSE bug 1201877cpe:/o:suse:suse-microos:5.0CVE-2017-5837SUSE Linux Enterprise Micro 5.0
The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted video file.
LowCVE-2017-5837SUSE bug 1023259SUSE bug 1024076SUSE bug 1024079cpe:/o:suse:suse-microos:5.0CVE-2017-5838SUSE Linux Enterprise Micro 5.0
The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a malformed datetime string.
ModerateCVE-2017-5838SUSE bug 1023259SUSE bug 1024051cpe:/o:suse:suse-microos:5.0CVE-2017-5839SUSE Linux Enterprise Micro 5.0
The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX.
LowCVE-2017-5839SUSE bug 1023259SUSE bug 1024047cpe:/o:suse:suse-microos:5.0CVE-2017-5840SUSE Linux Enterprise Micro 5.0
The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index.
LowCVE-2017-5840SUSE bug 1023259SUSE bug 1024034cpe:/o:suse:suse-microos:5.0CVE-2017-5841SUSE Linux Enterprise Micro 5.0
The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags.
LowCVE-2017-5841SUSE bug 1023259SUSE bug 1024030SUSE bug 1024062cpe:/o:suse:suse-microos:5.0CVE-2017-5842SUSE Linux Enterprise Micro 5.0
The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted SMI file, as demonstrated by OneNote_Manager.smi.
LowCVE-2017-5842SUSE bug 1023259SUSE bug 1024041cpe:/o:suse:suse-microos:5.0CVE-2017-5843SUSE Linux Enterprise Micro 5.0
Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags, as demonstrated by 02785736.mxf.
LowCVE-2017-5843SUSE bug 1023259SUSE bug 1024044cpe:/o:suse:suse-microos:5.0CVE-2017-5844SUSE Linux Enterprise Micro 5.0
The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted ASF file.
LowCVE-2017-5844SUSE bug 1023259SUSE bug 1024079cpe:/o:suse:suse-microos:5.0CVE-2017-5845SUSE Linux Enterprise Micro 5.0
The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that "goes behind" the surrounding tag.
LowCVE-2017-5845SUSE bug 1023259SUSE bug 1024062cpe:/o:suse:suse-microos:5.0CVE-2017-5846SUSE Linux Enterprise Micro 5.0
The gst_asf_demux_process_ext_stream_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors related to the number of languages in a video file.
ModerateCVE-2017-5846SUSE bug 1023259cpe:/o:suse:suse-microos:5.0CVE-2017-5847SUSE Linux Enterprise Micro 5.0
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
ModerateCVE-2017-5847SUSE bug 1023259cpe:/o:suse:suse-microos:5.0CVE-2017-5848SUSE Linux Enterprise Micro 5.0
The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM parsing.
LowCVE-2017-5848SUSE bug 1023259SUSE bug 1024068cpe:/o:suse:suse-microos:5.0CVE-2017-5856SUSE Linux Enterprise Micro 5.0
Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb.
LowCVE-2017-5856SUSE bug 1023053SUSE bug 1024186cpe:/o:suse:suse-microos:5.0CVE-2017-5857SUSE Linux Enterprise Micro 5.0
Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_UNREF commands sent without detaching the backing storage beforehand.
LowCVE-2017-5857SUSE bug 1023073cpe:/o:suse:suse-microos:5.0CVE-2017-5897SUSE Linux Enterprise Micro 5.0
The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access.
ModerateCVE-2017-5897SUSE bug 1023762SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2017-5898SUSE Linux Enterprise Micro 5.0
Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit.
LowCVE-2017-5898SUSE bug 1023907SUSE bug 1024307cpe:/o:suse:suse-microos:5.0CVE-2017-5931SUSE Linux Enterprise Micro 5.0
Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, which triggers a heap-based buffer overflow.
ImportantCVE-2017-5931SUSE bug 1024114cpe:/o:suse:suse-microos:5.0CVE-2017-5937SUSE Linux Enterprise Micro 5.0
The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.
ModerateCVE-2017-5937SUSE bug 1024232SUSE bug 1041089cpe:/o:suse:suse-microos:5.0CVE-2017-5950SUSE Linux Enterprise Micro 5.0
The SingleDocParser::HandleNode function in yaml-cpp (aka LibYaml-C++) 0.5.3 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
ModerateCVE-2017-5950SUSE bug 1032144cpe:/o:suse:suse-microos:5.0CVE-2017-5953SUSE Linux Enterprise Micro 5.0
vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
ImportantCVE-2017-5953SUSE bug 1024724SUSE bug 1123143SUSE bug 1173534cpe:/o:suse:suse-microos:5.0CVE-2017-5957SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the vrend_decode_set_framebuffer_state function in vrend_decode.c in virglrenderer before 926b9b3460a48f6454d8bbe9e44313d86a65447f, as used in Quick Emulator (QEMU), allows a local guest users to cause a denial of service (application crash) via the "nr_cbufs" argument.
ModerateCVE-2017-5957SUSE bug 1024993cpe:/o:suse:suse-microos:5.0CVE-2017-5967SUSE Linux Enterprise Micro 5.0
The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from PID values inside a PID namespace) by reading the /proc/timer_list file, related to the print_timer function in kernel/time/timer_list.c and the __timer_stats_timer_set_start_info function in kernel/time/timer.c.
LowCVE-2017-5967SUSE bug 1025209cpe:/o:suse:suse-microos:5.0CVE-2017-5969SUSE Linux Enterprise Micro 5.0
** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser."
ModerateCVE-2017-5969SUSE bug 1024989SUSE bug 1123919cpe:/o:suse:suse-microos:5.0CVE-2017-5972SUSE Linux Enterprise Micro 5.0
The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets, as demonstrated by an attack against the kernel-3.10.0 package in CentOS Linux 7. NOTE: third parties have been unable to discern any relationship between the GitHub Engineering finding and the Trigemini.c attack code.
ImportantCVE-2017-5972SUSE bug 1026173cpe:/o:suse:suse-microos:5.0CVE-2017-5973SUSE Linux Enterprise Micro 5.0
The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors related to control transfer descriptor sequence.
LowCVE-2017-5973SUSE bug 1025109SUSE bug 1025188cpe:/o:suse:suse-microos:5.0CVE-2017-5987SUSE Linux Enterprise Micro 5.0
The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors involving the transfer mode register during multi block transfer.
LowCVE-2017-5987SUSE bug 1025311cpe:/o:suse:suse-microos:5.0CVE-2017-5993SUSE Linux Enterprise Micro 5.0
Memory leak in the vrend_renderer_init_blit_ctx function in vrend_blitter.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGL_CCMD_BLIT commands.
LowCVE-2017-5993SUSE bug 1025505cpe:/o:suse:suse-microos:5.0CVE-2017-5994SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and crash) via the num_elements parameter.
LowCVE-2017-5994SUSE bug 1025507cpe:/o:suse:suse-microos:5.0CVE-2017-6001SUSE Linux Enterprise Micro 5.0
Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786.
ModerateCVE-2017-6001SUSE bug 1015160SUSE bug 1025626cpe:/o:suse:suse-microos:5.0CVE-2017-6004SUSE Linux Enterprise Micro 5.0
The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.
ImportantCVE-2017-6004SUSE bug 1025709SUSE bug 1191803SUSE bug 1193384cpe:/o:suse:suse-microos:5.0CVE-2017-6058SUSE Linux Enterprise Micro 5.0
Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxnet3 device, allows remote attackers to cause a denial of service (out-of-bounds access and QEMU process crash) via vectors related to VLAN stripping.
ImportantCVE-2017-6058SUSE bug 1025837cpe:/o:suse:suse-microos:5.0CVE-2017-6074SUSE Linux Enterprise Micro 5.0
The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.
ImportantCVE-2017-6074SUSE bug 1026024SUSE bug 1072204cpe:/o:suse:suse-microos:5.0CVE-2017-6345SUSE Linux Enterprise Micro 5.0
The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls.
ModerateCVE-2017-6345SUSE bug 1027179SUSE bug 1027190SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2017-6348SUSE Linux Enterprise Micro 5.0
The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages lock dropping, which allows local users to cause a denial of service (deadlock) via crafted operations on IrDA devices.
ModerateCVE-2017-6348SUSE bug 1027178SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2017-6349SUSE Linux Enterprise Micro 5.0
An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
ModerateCVE-2017-6349SUSE bug 1027057cpe:/o:suse:suse-microos:5.0CVE-2017-6350SUSE Linux Enterprise Micro 5.0
An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
ModerateCVE-2017-6350SUSE bug 1027053cpe:/o:suse:suse-microos:5.0CVE-2017-6353SUSE Linux Enterprise Micro 5.0
net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986.
ModerateCVE-2017-6353SUSE bug 1025235SUSE bug 1027066cpe:/o:suse:suse-microos:5.0CVE-2017-6386SUSE Linux Enterprise Micro 5.0
Memory leak in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGL_OBJECT_VERTEX_ELEMENTS commands.
LowCVE-2017-6386SUSE bug 1027376cpe:/o:suse:suse-microos:5.0CVE-2017-6414SUSE Linux Enterprise Micro 5.0
Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.
LowCVE-2017-6414SUSE bug 1027514SUSE bug 1027570cpe:/o:suse:suse-microos:5.0CVE-2017-6419SUSE Linux Enterprise Micro 5.0
mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.
ImportantCVE-2017-6419SUSE bug 1052449SUSE bug 1083915cpe:/o:suse:suse-microos:5.0CVE-2017-6505SUSE Linux Enterprise Micro 5.0
The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors, a different vulnerability than CVE-2017-9330.
LowCVE-2017-6505SUSE bug 1028184SUSE bug 1028235SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2017-6507SUSE Linux Enterprise Micro 5.0
An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic.
ModerateCVE-2017-6507SUSE bug 1029696cpe:/o:suse:suse-microos:5.0CVE-2017-6874SUSE Linux Enterprise Micro 5.0
Race condition in kernel/ucount.c in the Linux kernel through 4.10.2 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls that leverage certain decrement behavior that causes incorrect interaction between put_ucounts and get_ucounts.
ModerateCVE-2017-6874SUSE bug 1029314cpe:/o:suse:suse-microos:5.0CVE-2017-6891SUSE Linux Enterprise Micro 5.0
Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.
ModerateCVE-2017-6891SUSE bug 1040621SUSE bug 1149679cpe:/o:suse:suse-microos:5.0CVE-2017-6951SUSE Linux Enterprise Micro 5.0
The keyring_search_aux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the "dead" type.
ModerateCVE-2017-6951SUSE bug 1029850SUSE bug 1030593cpe:/o:suse:suse-microos:5.0CVE-2017-7186SUSE Linux Enterprise Micro 5.0
libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.
ModerateCVE-2017-7186SUSE bug 1030066SUSE bug 1037164cpe:/o:suse:suse-microos:5.0CVE-2017-7187SUSE Linux Enterprise Micro 5.0
The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function.
ModerateCVE-2017-7187SUSE bug 1027179SUSE bug 1030213SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-7244SUSE Linux Enterprise Micro 5.0
The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file.
ModerateCVE-2017-7244SUSE bug 1030807cpe:/o:suse:suse-microos:5.0CVE-2017-7245SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.
ModerateCVE-2017-7245SUSE bug 1030805cpe:/o:suse:suse-microos:5.0CVE-2017-7246SUSE Linux Enterprise Micro 5.0
Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.
ModerateCVE-2017-7246SUSE bug 1030803SUSE bug 1030805cpe:/o:suse:suse-microos:5.0CVE-2017-7273SUSE Linux Enterprise Micro 5.0
The cp_report_fixup function in drivers/hid/hid-cypress.c in the Linux kernel 3.2 and 4.x before 4.9.4 allows physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report.
ModerateCVE-2017-7273SUSE bug 1031240cpe:/o:suse:suse-microos:5.0CVE-2017-7435SUSE Linux Enterprise Micro 5.0
In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
ImportantCVE-2017-7435SUSE bug 1009127SUSE bug 1038984SUSE bug 1045735cpe:/o:suse:suse-microos:5.0CVE-2017-7436SUSE Linux Enterprise Micro 5.0
In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
ImportantCVE-2017-7436SUSE bug 1008325SUSE bug 1009127SUSE bug 1038984SUSE bug 1045735cpe:/o:suse:suse-microos:5.0CVE-2017-7468SUSE Linux Enterprise Micro 5.0
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
LowCVE-2017-7468SUSE bug 1033413SUSE bug 1033442SUSE bug 1042181SUSE bug 991389cpe:/o:suse:suse-microos:5.0CVE-2017-7471SUSE Linux Enterprise Micro 5.0
Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.
ModerateCVE-2017-7471SUSE bug 1034866SUSE bug 1034990cpe:/o:suse:suse-microos:5.0CVE-2017-7472SUSE Linux Enterprise Micro 5.0
The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.
ModerateCVE-2017-7472SUSE bug 1034862cpe:/o:suse:suse-microos:5.0CVE-2017-7475SUSE Linux Enterprise Micro 5.0
Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
ModerateCVE-2017-7475SUSE bug 1036789cpe:/o:suse:suse-microos:5.0CVE-2017-7476SUSE Linux Enterprise Micro 5.0
Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_rz.c.
ModerateCVE-2017-7476SUSE bug 1036636SUSE bug 1037124SUSE bug 1037125SUSE bug 1037142cpe:/o:suse:suse-microos:5.0CVE-2017-7482SUSE Linux Enterprise Micro 5.0
In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation.
ModerateCVE-2017-7482SUSE bug 1046107SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-7487SUSE Linux Enterprise Micro 5.0
The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.
ModerateCVE-2017-7487SUSE bug 1038879SUSE bug 1038883SUSE bug 1038981SUSE bug 1038982SUSE bug 1072204SUSE bug 1115893SUSE bug 870618cpe:/o:suse:suse-microos:5.0CVE-2017-7493SUSE Linux Enterprise Micro 5.0
Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest.
ImportantCVE-2017-7493SUSE bug 1039495cpe:/o:suse:suse-microos:5.0CVE-2017-7495SUSE Linux Enterprise Micro 5.0
fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users to obtain sensitive information from other users' files in opportunistic circumstances by waiting for a hardware reset, creating a new file, making write system calls, and reading this file.
ModerateCVE-2017-7495SUSE bug 1039010cpe:/o:suse:suse-microos:5.0CVE-2017-7500SUSE Linux Enterprise Micro 5.0
It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.
ImportantCVE-2017-7500SUSE bug 1126909SUSE bug 1135195SUSE bug 1157882SUSE bug 1157883SUSE bug 943457SUSE bug 964063cpe:/o:suse:suse-microos:5.0CVE-2017-7501SUSE Linux Enterprise Micro 5.0
It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.
ImportantCVE-2017-7501SUSE bug 1119217SUSE bug 1126909SUSE bug 1135195SUSE bug 1157882SUSE bug 1157883SUSE bug 943457cpe:/o:suse:suse-microos:5.0CVE-2017-7518SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate their privileges inside the guest. Linux guests are not affected by this.
ModerateCVE-2017-7518SUSE bug 1045922SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2017-7526SUSE Linux Enterprise Micro 5.0
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.
LowCVE-2017-7526SUSE bug 1046607SUSE bug 1047462SUSE bug 1123792cpe:/o:suse:suse-microos:5.0CVE-2017-7542SUSE Linux Enterprise Micro 5.0
The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket.
ModerateCVE-2017-7542SUSE bug 1049882SUSE bug 1061936cpe:/o:suse:suse-microos:5.0CVE-2017-7555SUSE Linux Enterprise Micro 5.0
Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.
ModerateCVE-2017-7555SUSE bug 1054171cpe:/o:suse:suse-microos:5.0CVE-2017-7607SUSE Linux Enterprise Micro 5.0
The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
ModerateCVE-2017-7607SUSE bug 1033084cpe:/o:suse:suse-microos:5.0CVE-2017-7608SUSE Linux Enterprise Micro 5.0
The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
LowCVE-2017-7608SUSE bug 1033085cpe:/o:suse:suse-microos:5.0CVE-2017-7609SUSE Linux Enterprise Micro 5.0
elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.
LowCVE-2017-7609SUSE bug 1033086cpe:/o:suse:suse-microos:5.0CVE-2017-7610SUSE Linux Enterprise Micro 5.0
The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
LowCVE-2017-7610SUSE bug 1033087cpe:/o:suse:suse-microos:5.0CVE-2017-7611SUSE Linux Enterprise Micro 5.0
The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
LowCVE-2017-7611SUSE bug 1033088cpe:/o:suse:suse-microos:5.0CVE-2017-7612SUSE Linux Enterprise Micro 5.0
The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
LowCVE-2017-7612SUSE bug 1033089cpe:/o:suse:suse-microos:5.0CVE-2017-7613SUSE Linux Enterprise Micro 5.0
elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.
LowCVE-2017-7613SUSE bug 1033090cpe:/o:suse:suse-microos:5.0CVE-2017-7618SUSE Linux Enterprise Micro 5.0
crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling its own callback, and infinite recursion) by triggering EBUSY on a full queue.
ImportantCVE-2017-7618SUSE bug 1033340cpe:/o:suse:suse-microos:5.0CVE-2017-7645SUSE Linux Enterprise Micro 5.0
The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c.
ImportantCVE-2017-7645SUSE bug 1034670SUSE bug 1036741SUSE bug 1046191SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2017-7869SUSE Linux Enterprise Micro 5.0
GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.
CriticalCVE-2017-7869SUSE bug 1034173SUSE bug 1038337SUSE bug 1149679cpe:/o:suse:suse-microos:5.0CVE-2017-7874SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
ImportantCVE-2017-7874SUSE bug 1034330SUSE bug 493158cpe:/o:suse:suse-microos:5.0CVE-2017-7889SUSE Linux Enterprise Micro 5.0
The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c.
ModerateCVE-2017-7889SUSE bug 1034405cpe:/o:suse:suse-microos:5.0CVE-2017-7960SUSE Linux Enterprise Micro 5.0
The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.
ModerateCVE-2017-7960SUSE bug 1034481cpe:/o:suse:suse-microos:5.0CVE-2017-7961SUSE Linux Enterprise Micro 5.0
** DISPUTED ** The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an "outside the range of representable values of type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports "This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components."
LowCVE-2017-7961SUSE bug 1034482SUSE bug 1132069cpe:/o:suse:suse-microos:5.0CVE-2017-7980SUSE Linux Enterprise Micro 5.0
Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.
ModerateCVE-2017-7980SUSE bug 1035406SUSE bug 1035483cpe:/o:suse:suse-microos:5.0CVE-2017-8105SUSE Linux Enterprise Micro 5.0
FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.
ModerateCVE-2017-8105SUSE bug 1034186SUSE bug 1035807SUSE bug 1036457SUSE bug 1079459cpe:/o:suse:suse-microos:5.0CVE-2017-8106SUSE Linux Enterprise Micro 5.0
The handle_invept function in arch/x86/kvm/vmx.c in the Linux kernel 3.12 through 3.15 allows privileged KVM guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a single-context INVEPT instruction with a NULL EPT pointer.
LowCVE-2017-8106SUSE bug 1035877cpe:/o:suse:suse-microos:5.0CVE-2017-8112SUSE Linux Enterprise Micro 5.0
hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via the message ring page count.
LowCVE-2017-8112SUSE bug 1036211SUSE bug 1036470cpe:/o:suse:suse-microos:5.0CVE-2017-8287SUSE Linux Enterprise Micro 5.0
FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c.
ImportantCVE-2017-8287SUSE bug 1034186SUSE bug 1035807SUSE bug 1036457SUSE bug 1079459cpe:/o:suse:suse-microos:5.0CVE-2017-8309SUSE Linux Enterprise Micro 5.0
Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture.
LowCVE-2017-8309SUSE bug 1037242SUSE bug 1037243SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2017-8379SUSE Linux Enterprise Micro 5.0
Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large keyboard events.
LowCVE-2017-8379SUSE bug 1037334cpe:/o:suse:suse-microos:5.0CVE-2017-8380SUSE Linux Enterprise Micro 5.0
Buffer overflow in the "megasas_mmio_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors.
LowCVE-2017-8380SUSE bug 1037336cpe:/o:suse:suse-microos:5.0CVE-2017-8779SUSE Linux Enterprise Micro 5.0
rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.
ImportantCVE-2017-8779SUSE bug 1037559SUSE bug 1037930SUSE bug 1101814SUSE bug 798028cpe:/o:suse:suse-microos:5.0CVE-2017-8786SUSE Linux Enterprise Micro 5.0
pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
LowCVE-2017-8786SUSE bug 1036942SUSE bug 1037718cpe:/o:suse:suse-microos:5.0CVE-2017-8797SUSE Linux Enterprise Micro 5.0
The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.
ImportantCVE-2017-8797SUSE bug 1046202SUSE bug 1046206cpe:/o:suse:suse-microos:5.0CVE-2017-8813SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-8831. Reason: This candidate is a duplicate of CVE-2017-8831. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2017-8831 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
ModerateCVE-2017-8813SUSE bug 1070849SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2017-8816SUSE Linux Enterprise Micro 5.0
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.
ModerateCVE-2017-8816SUSE bug 1069226SUSE bug 1106019cpe:/o:suse:suse-microos:5.0CVE-2017-8817SUSE Linux Enterprise Micro 5.0
The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.
ModerateCVE-2017-8817SUSE bug 1069222cpe:/o:suse:suse-microos:5.0CVE-2017-8818SUSE Linux Enterprise Micro 5.0
curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.
CriticalCVE-2017-8818SUSE bug 1069714cpe:/o:suse:suse-microos:5.0CVE-2017-8824SUSE Linux Enterprise Micro 5.0
The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state.
ImportantCVE-2017-8824SUSE bug 1070771SUSE bug 1076734SUSE bug 1092904SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-8831SUSE Linux Enterprise Micro 5.0
The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch" vulnerability.
ModerateCVE-2017-8831SUSE bug 1037994SUSE bug 1061936SUSE bug 1087082SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-8834SUSE Linux Enterprise Micro 5.0
The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.
LowCVE-2017-8834SUSE bug 1043898SUSE bug 1043899cpe:/o:suse:suse-microos:5.0CVE-2017-8871SUSE Linux Enterprise Micro 5.0
The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file.
LowCVE-2017-8871SUSE bug 1043898SUSE bug 1043899cpe:/o:suse:suse-microos:5.0CVE-2017-8872SUSE Linux Enterprise Micro 5.0
The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.
ModerateCVE-2017-8872SUSE bug 1038444SUSE bug 1123919cpe:/o:suse:suse-microos:5.0CVE-2017-8890SUSE Linux Enterprise Micro 5.0
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call.
ImportantCVE-2017-8890SUSE bug 1038544SUSE bug 1038564SUSE bug 1039883SUSE bug 1039885SUSE bug 1040069SUSE bug 1042364SUSE bug 1051906SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-9047SUSE Linux Enterprise Micro 5.0
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.
ModerateCVE-2017-9047SUSE bug 1039063SUSE bug 1039066SUSE bug 1039657SUSE bug 1123919cpe:/o:suse:suse-microos:5.0CVE-2017-9048SUSE Linux Enterprise Micro 5.0
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.
ModerateCVE-2017-9048SUSE bug 1039064SUSE bug 1039066SUSE bug 1039658cpe:/o:suse:suse-microos:5.0CVE-2017-9049SUSE Linux Enterprise Micro 5.0
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.
ImportantCVE-2017-9049SUSE bug 1039063SUSE bug 1039064SUSE bug 1039066SUSE bug 1039659SUSE bug 1039661SUSE bug 1069690SUSE bug 1123919cpe:/o:suse:suse-microos:5.0CVE-2017-9074SUSE Linux Enterprise Micro 5.0
The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls.
ModerateCVE-2017-9074SUSE bug 1039882SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-9075SUSE Linux Enterprise Micro 5.0
The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.
ImportantCVE-2017-9075SUSE bug 1038544SUSE bug 1039883SUSE bug 1051906SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-9076SUSE Linux Enterprise Micro 5.0
The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.
ImportantCVE-2017-9076SUSE bug 1038544SUSE bug 1039885SUSE bug 1040069SUSE bug 1051906SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-9077SUSE Linux Enterprise Micro 5.0
The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.
ImportantCVE-2017-9077SUSE bug 1038544SUSE bug 1040069SUSE bug 1042364SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2017-9227SUSE Linux Enterprise Micro 5.0
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.
LowCVE-2017-9227SUSE bug 1040883SUSE bug 1044976cpe:/o:suse:suse-microos:5.0CVE-2017-9233SUSE Linux Enterprise Micro 5.0
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
ImportantCVE-2017-9233SUSE bug 1030296SUSE bug 1047236SUSE bug 1073350SUSE bug 1123115SUSE bug 983216cpe:/o:suse:suse-microos:5.0CVE-2017-9242SUSE Linux Enterprise Micro 5.0
The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service (system crash) via crafted system calls.
ImportantCVE-2017-9242SUSE bug 1041431SUSE bug 1042892cpe:/o:suse:suse-microos:5.0CVE-2017-9269SUSE Linux Enterprise Micro 5.0
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
ImportantCVE-2017-9269SUSE bug 1038984SUSE bug 1045735cpe:/o:suse:suse-microos:5.0CVE-2017-9271SUSE Linux Enterprise Micro 5.0
The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used.
ModerateCVE-2017-9271SUSE bug 1050625cpe:/o:suse:suse-microos:5.0CVE-2017-9330SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different vulnerability than CVE-2017-6505.
LowCVE-2017-9330SUSE bug 1042159SUSE bug 1042160SUSE bug 1043157SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2017-9445SUSE Linux Enterprise Micro 5.0
In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.
ImportantCVE-2017-9445SUSE bug 1045290SUSE bug 1063249cpe:/o:suse:suse-microos:5.0CVE-2017-9502SUSE Linux Enterprise Micro 5.0
In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string "file://").
ModerateCVE-2017-9502SUSE bug 1044243cpe:/o:suse:suse-microos:5.0CVE-2017-9503SUSE Linux Enterprise Micro 5.0
QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving megasas command processing.
LowCVE-2017-9503SUSE bug 1043296SUSE bug 1043297SUSE bug 1043312cpe:/o:suse:suse-microos:5.0CVE-2017-9524SUSE Linux Enterprise Micro 5.0
The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all initialization occurs before talking to a client in the nbd_negotiate function.
ModerateCVE-2017-9524SUSE bug 1043808cpe:/o:suse:suse-microos:5.0CVE-2017-9614SUSE Linux Enterprise Micro 5.0
** DISPUTED ** The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted jpg file. NOTE: Maintainer asserts the issue is due to a bug in downstream code caused by misuse of the libjpeg API.
ImportantCVE-2017-9614SUSE bug 1050231cpe:/o:suse:suse-microos:5.0CVE-2017-9814SUSE Linux Enterprise Micro 5.0
cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mishandling of an unexpected malloc(0) call.
LowCVE-2017-9814SUSE bug 1049092cpe:/o:suse:suse-microos:5.0CVE-2017-9984SUSE Linux Enterprise Micro 5.0
The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability.
ModerateCVE-2017-9984SUSE bug 1046599SUSE bug 1087082SUSE bug 187396cpe:/o:suse:suse-microos:5.0CVE-2017-9985SUSE Linux Enterprise Micro 5.0
The snd_msndmidi_input_read function in sound/isa/msnd/msnd_midi.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability.
ModerateCVE-2017-9985SUSE bug 1046601SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2017-9986SUSE Linux Enterprise Micro 5.0
The intr function in sound/oss/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability.
ModerateCVE-2017-9986SUSE bug 1046600cpe:/o:suse:suse-microos:5.0CVE-2018-0495SUSE Linux Enterprise Micro 5.0
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
ModerateCVE-2018-0495SUSE bug 1097410SUSE bug 1121207cpe:/o:suse:suse-microos:5.0CVE-2018-0500SUSE Linux Enterprise Micro 5.0
Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).
ImportantCVE-2018-0500SUSE bug 1099793cpe:/o:suse:suse-microos:5.0CVE-2018-0732SUSE Linux Enterprise Micro 5.0
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
ImportantCVE-2018-0732SUSE bug 1077628SUSE bug 1097158SUSE bug 1099502SUSE bug 1106692SUSE bug 1108542SUSE bug 1110163SUSE bug 1112097SUSE bug 1122198SUSE bug 1148697cpe:/o:suse:suse-microos:5.0CVE-2018-0734SUSE Linux Enterprise Micro 5.0
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).
ModerateCVE-2018-0734SUSE bug 1113534SUSE bug 1113652SUSE bug 1113742SUSE bug 1122198SUSE bug 1122212SUSE bug 1126909SUSE bug 1148697cpe:/o:suse:suse-microos:5.0CVE-2018-0735SUSE Linux Enterprise Micro 5.0
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).
ModerateCVE-2018-0735SUSE bug 1113534SUSE bug 1113651cpe:/o:suse:suse-microos:5.0CVE-2018-0737SUSE Linux Enterprise Micro 5.0
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).
ModerateCVE-2018-0737SUSE bug 1089039SUSE bug 1089041SUSE bug 1089044SUSE bug 1089045SUSE bug 1108542SUSE bug 1123780SUSE bug 1126909cpe:/o:suse:suse-microos:5.0CVE-2018-0739SUSE Linux Enterprise Micro 5.0
Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
ImportantCVE-2018-0739SUSE bug 1087102SUSE bug 1089997SUSE bug 1094291SUSE bug 1108542cpe:/o:suse:suse-microos:5.0CVE-2018-1000001SUSE Linux Enterprise Micro 5.0
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
ImportantCVE-2018-1000001SUSE bug 1074293SUSE bug 1099047SUSE bug 1123874cpe:/o:suse:suse-microos:5.0CVE-2018-1000004SUSE Linux Enterprise Micro 5.0
In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition.
ModerateCVE-2018-1000004SUSE bug 1076017SUSE bug 1091815cpe:/o:suse:suse-microos:5.0CVE-2018-1000005SUSE Linux Enterprise Micro 5.0
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something.
CriticalCVE-2018-1000005SUSE bug 1076360cpe:/o:suse:suse-microos:5.0CVE-2018-1000007SUSE Linux Enterprise Micro 5.0
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
ModerateCVE-2018-1000007SUSE bug 1077001SUSE bug 1145903SUSE bug 1185551SUSE bug 1192797SUSE bug 1198766cpe:/o:suse:suse-microos:5.0CVE-2018-1000073SUSE Linux Enterprise Micro 5.0
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.
ModerateCVE-2018-1000073SUSE bug 1082007cpe:/o:suse:suse-microos:5.0CVE-2018-1000074SUSE Linux Enterprise Micro 5.0
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.
ImportantCVE-2018-1000074SUSE bug 1082008SUSE bug 1175764cpe:/o:suse:suse-microos:5.0CVE-2018-1000075SUSE Linux Enterprise Micro 5.0
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.
LowCVE-2018-1000075SUSE bug 1082014cpe:/o:suse:suse-microos:5.0CVE-2018-1000076SUSE Linux Enterprise Micro 5.0
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.
ModerateCVE-2018-1000076SUSE bug 1082009cpe:/o:suse:suse-microos:5.0CVE-2018-1000077SUSE Linux Enterprise Micro 5.0
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.
ModerateCVE-2018-1000077SUSE bug 1082010SUSE bug 1183937cpe:/o:suse:suse-microos:5.0CVE-2018-1000078SUSE Linux Enterprise Micro 5.0
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.
ModerateCVE-2018-1000078SUSE bug 1082011cpe:/o:suse:suse-microos:5.0CVE-2018-1000079SUSE Linux Enterprise Micro 5.0
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
ModerateCVE-2018-1000079SUSE bug 1082058cpe:/o:suse:suse-microos:5.0CVE-2018-1000120SUSE Linux Enterprise Micro 5.0
A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.
ModerateCVE-2018-1000120SUSE bug 1084521SUSE bug 1101811SUSE bug 1112526cpe:/o:suse:suse-microos:5.0CVE-2018-1000121SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service
LowCVE-2018-1000121SUSE bug 1084524SUSE bug 1085215SUSE bug 1101811SUSE bug 1112526cpe:/o:suse:suse-microos:5.0CVE-2018-1000122SUSE Linux Enterprise Micro 5.0
A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage
ModerateCVE-2018-1000122SUSE bug 1084532SUSE bug 1101811SUSE bug 1112526cpe:/o:suse:suse-microos:5.0CVE-2018-1000135SUSE Linux Enterprise Micro 5.0
GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.
ModerateCVE-2018-1000135SUSE bug 1086263cpe:/o:suse:suse-microos:5.0CVE-2018-1000168SUSE Linux Enterprise Micro 5.0
nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.
ModerateCVE-2018-1000168SUSE bug 1088639SUSE bug 1097401cpe:/o:suse:suse-microos:5.0CVE-2018-1000204SUSE Linux Enterprise Micro 5.0
** DISPUTED ** Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it "virtually impossible to exploit."
ModerateCVE-2018-1000204SUSE bug 1096728SUSE bug 1105412cpe:/o:suse:suse-microos:5.0CVE-2018-1000300SUSE Linux Enterprise Micro 5.0
curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0.
CriticalCVE-2018-1000300SUSE bug 1092094cpe:/o:suse:suse-microos:5.0CVE-2018-1000301SUSE Linux Enterprise Micro 5.0
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.
CriticalCVE-2018-1000301SUSE bug 1092098SUSE bug 1122464cpe:/o:suse:suse-microos:5.0CVE-2018-1000654SUSE Linux Enterprise Micro 5.0
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.
ModerateCVE-2018-1000654SUSE bug 1105435cpe:/o:suse:suse-microos:5.0CVE-2018-1000802SUSE Linux Enterprise Micro 5.0
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.
ModerateCVE-2018-1000802SUSE bug 1109663cpe:/o:suse:suse-microos:5.0CVE-2018-1000807SUSE Linux Enterprise Micro 5.0
Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.
ImportantCVE-2018-1000807SUSE bug 1111634SUSE bug 1111635cpe:/o:suse:suse-microos:5.0CVE-2018-1000808SUSE Linux Enterprise Micro 5.0
Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.
ModerateCVE-2018-1000808SUSE bug 1111634SUSE bug 1111635cpe:/o:suse:suse-microos:5.0CVE-2018-1000858SUSE Linux Enterprise Micro 5.0
GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.
ModerateCVE-2018-1000858SUSE bug 1120346cpe:/o:suse:suse-microos:5.0CVE-2018-10021SUSE Linux Enterprise Micro 5.0
** DISPUTED ** drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the relevance of this report because the failure can only occur for physically proximate attackers who unplug SAS Host Bus Adapter cables.
ModerateCVE-2018-10021SUSE bug 1087082SUSE bug 1089281cpe:/o:suse:suse-microos:5.0CVE-2018-10322SUSE Linux Enterprise Micro 5.0
The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a crafted xfs image.
ModerateCVE-2018-10322SUSE bug 1087082SUSE bug 1090749cpe:/o:suse:suse-microos:5.0CVE-2018-10323SUSE Linux Enterprise Micro 5.0
The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image.
ModerateCVE-2018-10323SUSE bug 1087082SUSE bug 1090717cpe:/o:suse:suse-microos:5.0CVE-2018-10360SUSE Linux Enterprise Micro 5.0
The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.
LowCVE-2018-10360SUSE bug 1096974SUSE bug 1096984SUSE bug 1126118cpe:/o:suse:suse-microos:5.0CVE-2018-10392SUSE Linux Enterprise Micro 5.0
mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.
ModerateCVE-2018-10392SUSE bug 1091070cpe:/o:suse:suse-microos:5.0CVE-2018-10393SUSE Linux Enterprise Micro 5.0
bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.
ModerateCVE-2018-10393SUSE bug 1091072cpe:/o:suse:suse-microos:5.0CVE-2018-10471SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754.
ModerateCVE-2018-10471SUSE bug 1089635SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-10472SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users (in certain configurations) to read arbitrary dom0 files via QMP live insertion of a CDROM, in conjunction with specifying the target file as the backing file of a snapshot.
ModerateCVE-2018-10472SUSE bug 1089152cpe:/o:suse:suse-microos:5.0CVE-2018-1060SUSE Linux Enterprise Micro 5.0
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
LowCVE-2018-1060SUSE bug 1088009cpe:/o:suse:suse-microos:5.0CVE-2018-1061SUSE Linux Enterprise Micro 5.0
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.
ModerateCVE-2018-1061SUSE bug 1088004cpe:/o:suse:suse-microos:5.0CVE-2018-1063SUSE Linux Enterprise Micro 5.0
Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.
ModerateCVE-2018-1063SUSE bug 1083624cpe:/o:suse:suse-microos:5.0CVE-2018-1064SUSE Linux Enterprise Micro 5.0
libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent.
ModerateCVE-2018-1064SUSE bug 1076500SUSE bug 1083625SUSE bug 1087887SUSE bug 1088147cpe:/o:suse:suse-microos:5.0CVE-2018-10675SUSE Linux Enterprise Micro 5.0
The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.
ModerateCVE-2018-10675SUSE bug 1087082SUSE bug 1091755SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2018-10839SUSE Linux Enterprise Micro 5.0
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
ModerateCVE-2018-10839SUSE bug 1110910SUSE bug 1110924cpe:/o:suse:suse-microos:5.0CVE-2018-10844SUSE Linux Enterprise Micro 5.0
It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.
ModerateCVE-2018-10844SUSE bug 1105437SUSE bug 1105459cpe:/o:suse:suse-microos:5.0CVE-2018-10845SUSE Linux Enterprise Micro 5.0
It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.
ModerateCVE-2018-10845SUSE bug 1105437SUSE bug 1105459cpe:/o:suse:suse-microos:5.0CVE-2018-10846SUSE Linux Enterprise Micro 5.0
A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.
ModerateCVE-2018-10846SUSE bug 1105460cpe:/o:suse:suse-microos:5.0CVE-2018-10856SUSE Linux Enterprise Micro 5.0
It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.
ModerateCVE-2018-10856SUSE bug 1097970cpe:/o:suse:suse-microos:5.0CVE-2018-10873SUSE Linux Enterprise Micro 5.0
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
ImportantCVE-2018-10873SUSE bug 1104448cpe:/o:suse:suse-microos:5.0CVE-2018-10880SUSE Linux Enterprise Micro 5.0
Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service.
ModerateCVE-2018-10880SUSE bug 1087082SUSE bug 1099845cpe:/o:suse:suse-microos:5.0CVE-2018-10882SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image.
ModerateCVE-2018-10882SUSE bug 1087082SUSE bug 1099849cpe:/o:suse:suse-microos:5.0CVE-2018-10892SUSE Linux Enterprise Micro 5.0
The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.
ModerateCVE-2018-10892SUSE bug 1100331SUSE bug 1100838cpe:/o:suse:suse-microos:5.0CVE-2018-10893SUSE Linux Enterprise Micro 5.0
Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code.
ModerateCVE-2018-10893SUSE bug 1101295cpe:/o:suse:suse-microos:5.0CVE-2018-10906SUSE Linux Enterprise Micro 5.0
In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.
ModerateCVE-2018-10906SUSE bug 1101797SUSE bug 1127346SUSE bug 1127350cpe:/o:suse:suse-microos:5.0CVE-2018-10932SUSE Linux Enterprise Micro 5.0
lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal.
ModerateCVE-2018-10932SUSE bug 1104624cpe:/o:suse:suse-microos:5.0CVE-2018-10933SUSE Linux Enterprise Micro 5.0
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.
CriticalCVE-2018-10933SUSE bug 1108020SUSE bug 1122198cpe:/o:suse:suse-microos:5.0CVE-2018-1095SUSE Linux Enterprise Micro 5.0
The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image.
ModerateCVE-2018-1095SUSE bug 1087004SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2018-10981SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (host OS infinite loop) in situations where a QEMU device model attempts to make invalid transitions between states of a request.
ModerateCVE-2018-10981SUSE bug 1090823SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-10982SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (unexpectedly high interrupt number, array overrun, and hypervisor crash) or possibly gain hypervisor privileges by setting up an HPET timer to deliver interrupts in IO-APIC mode, aka vHPET interrupt injection.
ImportantCVE-2018-10982SUSE bug 1090822SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-1116SUSE Linux Enterprise Micro 5.0
A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.
LowCVE-2018-1116SUSE bug 1099031cpe:/o:suse:suse-microos:5.0CVE-2018-1122SUSE Linux Enterprise Micro 5.0
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.
CVE-2018-1122SUSE bug 1087082SUSE bug 1092100SUSE bug 1093158SUSE bug 1123135SUSE bug 1126909SUSE bug 1128955cpe:/o:suse:suse-microos:5.0CVE-2018-1123SUSE Linux Enterprise Micro 5.0
procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).
CVE-2018-1123SUSE bug 1087082SUSE bug 1092100SUSE bug 1093158SUSE bug 1123135SUSE bug 1126909SUSE bug 1128955cpe:/o:suse:suse-microos:5.0CVE-2018-11236SUSE Linux Enterprise Micro 5.0
stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
ImportantCVE-2018-11236SUSE bug 1094161SUSE bug 1110160SUSE bug 1118435SUSE bug 1123874cpe:/o:suse:suse-microos:5.0CVE-2018-11237SUSE Linux Enterprise Micro 5.0
An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.
ModerateCVE-2018-11237SUSE bug 1092877SUSE bug 1094154SUSE bug 1118435cpe:/o:suse:suse-microos:5.0CVE-2018-1124SUSE Linux Enterprise Micro 5.0
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.
CVE-2018-1124SUSE bug 1087082SUSE bug 1092100SUSE bug 1093158SUSE bug 1123135SUSE bug 1126909SUSE bug 1128955cpe:/o:suse:suse-microos:5.0CVE-2018-1125SUSE Linux Enterprise Micro 5.0
procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.
CVE-2018-1125SUSE bug 1087082SUSE bug 1092100SUSE bug 1093158SUSE bug 1123135SUSE bug 1126909SUSE bug 1128955cpe:/o:suse:suse-microos:5.0CVE-2018-1126SUSE Linux Enterprise Micro 5.0
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.
CVE-2018-1126SUSE bug 1087082SUSE bug 1092100SUSE bug 1093158SUSE bug 1123135SUSE bug 1126909SUSE bug 1128955cpe:/o:suse:suse-microos:5.0CVE-2018-11412SUSE Linux Enterprise Micro 5.0
In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode.
ModerateCVE-2018-11412SUSE bug 1087082SUSE bug 1094678cpe:/o:suse:suse-microos:5.0CVE-2018-1152SUSE Linux Enterprise Micro 5.0
libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.
ModerateCVE-2018-1152SUSE bug 1098155cpe:/o:suse:suse-microos:5.0CVE-2018-11806SUSE Linux Enterprise Micro 5.0
m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
ModerateCVE-2018-11806SUSE bug 1096223SUSE bug 1096224SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-11813SUSE Linux Enterprise Micro 5.0
libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.
ModerateCVE-2018-11813SUSE bug 1096209SUSE bug 1172994SUSE bug 1172995cpe:/o:suse:suse-microos:5.0CVE-2018-12015SUSE Linux Enterprise Micro 5.0
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.
LowCVE-2018-12015SUSE bug 1096718SUSE bug 1099497SUSE bug 1099507SUSE bug 1106717cpe:/o:suse:suse-microos:5.0CVE-2018-12020SUSE Linux Enterprise Micro 5.0
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
ImportantCVE-2018-12020SUSE bug 1096745SUSE bug 1101134cpe:/o:suse:suse-microos:5.0CVE-2018-12126SUSE Linux Enterprise Micro 5.0
Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
ModerateCVE-2018-12126SUSE bug 1103186SUSE bug 1111331SUSE bug 1132686SUSE bug 1135409SUSE bug 1135524SUSE bug 1137916SUSE bug 1138534SUSE bug 1141977SUSE bug 1149725SUSE bug 1149726SUSE bug 1149729SUSE bug 1178658SUSE bug 1201877cpe:/o:suse:suse-microos:5.0CVE-2018-12127SUSE Linux Enterprise Micro 5.0
Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
ModerateCVE-2018-12127SUSE bug 1103186SUSE bug 1111331SUSE bug 1132686SUSE bug 1135409SUSE bug 1138534SUSE bug 1141977SUSE bug 1178658SUSE bug 1201877cpe:/o:suse:suse-microos:5.0CVE-2018-12130SUSE Linux Enterprise Micro 5.0
Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
ModerateCVE-2018-12130SUSE bug 1103186SUSE bug 1111331SUSE bug 1132686SUSE bug 1135409SUSE bug 1137916SUSE bug 1138534SUSE bug 1141977SUSE bug 1178658SUSE bug 1201877cpe:/o:suse:suse-microos:5.0CVE-2018-12207SUSE Linux Enterprise Micro 5.0
Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.
ModerateCVE-2018-12207SUSE bug 1117665SUSE bug 1139073SUSE bug 1152505SUSE bug 1155812SUSE bug 1155817SUSE bug 1155945SUSE bug 1178658SUSE bug 1201877cpe:/o:suse:suse-microos:5.0CVE-2018-12232SUSE Linux Enterprise Micro 5.0
In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.
CVE-2018-12232SUSE bug 1087082SUSE bug 1097593SUSE bug 1125907SUSE bug 1127757cpe:/o:suse:suse-microos:5.0CVE-2018-12384SUSE Linux Enterprise Micro 5.0
When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
ModerateCVE-2018-12384SUSE bug 1106873SUSE bug 1119105SUSE bug 1121207cpe:/o:suse:suse-microos:5.0CVE-2018-12404SUSE Linux Enterprise Micro 5.0
A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.
ModerateCVE-2018-12404SUSE bug 1119069SUSE bug 1119105SUSE bug 1121207cpe:/o:suse:suse-microos:5.0CVE-2018-12617SUSE Linux Enterprise Micro 5.0
qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.
ModerateCVE-2018-12617SUSE bug 1098735SUSE bug 1098744cpe:/o:suse:suse-microos:5.0CVE-2018-12891SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of attacks, due to them lacking preemption checks altogether in the affected code paths. Only x86 systems are affected. ARM systems are not affected. Only multi-vCPU x86 PV guests can leverage the vulnerability. x86 HVM or PVH guests as well as x86 single-vCPU PV ones cannot leverage the vulnerability.
ImportantCVE-2018-12891SUSE bug 1097521SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-12892SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host and guest together usually support PVHVM, the issue is exploitable only if the malicious guest administrator has control of the guest kernel or guest kernel command line.
ImportantCVE-2018-12892SUSE bug 1097523cpe:/o:suse:suse-microos:5.0CVE-2018-12893SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.10.x. One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with debug exceptions. Unfortunately, due to an oversight, at least one of these safety checks can be triggered by a guest. A malicious PV guest can crash Xen, leading to a Denial of Service. All Xen systems which have applied the XSA-260 fix are vulnerable. Only x86 systems are vulnerable. ARM systems are not vulnerable. Only x86 PV guests can exploit the vulnerability. x86 HVM and PVH guests cannot exploit the vulnerability. An attacker needs to be able to control hardware debugging facilities to exploit the vulnerability, but such permissions are typically available to unprivileged users.
ImportantCVE-2018-12893SUSE bug 1097522SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-12928SUSE Linux Enterprise Micro 5.0
In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur during a mount of a crafted hfs filesystem.
ModerateCVE-2018-12928SUSE bug 1099613cpe:/o:suse:suse-microos:5.0CVE-2018-12930SUSE Linux Enterprise Micro 5.0
ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.
ImportantCVE-2018-12930SUSE bug 1099619cpe:/o:suse:suse-microos:5.0CVE-2018-13053SUSE Linux Enterprise Micro 5.0
The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used.
LowCVE-2018-13053SUSE bug 1099924SUSE bug 1115893cpe:/o:suse:suse-microos:5.0CVE-2018-13096SUSE Linux Enterprise Micro 5.0
An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of-bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted f2fs image.
ModerateCVE-2018-13096SUSE bug 1100062cpe:/o:suse:suse-microos:5.0CVE-2018-13405SUSE Linux Enterprise Micro 5.0
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.
ModerateCVE-2018-13405SUSE bug 1087082SUSE bug 1100416SUSE bug 1129735SUSE bug 1195161SUSE bug 1198702cpe:/o:suse:suse-microos:5.0CVE-2018-13785SUSE Linux Enterprise Micro 5.0
In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.
LowCVE-2018-13785SUSE bug 1100687SUSE bug 1112153SUSE bug 1116574cpe:/o:suse:suse-microos:5.0CVE-2018-14404SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
ModerateCVE-2018-14404SUSE bug 1102046SUSE bug 1148896cpe:/o:suse:suse-microos:5.0CVE-2018-14498SUSE Linux Enterprise Micro 5.0
get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.
LowCVE-2018-14498SUSE bug 1128712cpe:/o:suse:suse-microos:5.0CVE-2018-14526SUSE Linux Enterprise Micro 5.0
An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information.
ModerateCVE-2018-14526SUSE bug 1104205cpe:/o:suse:suse-microos:5.0CVE-2018-14550SUSE Linux Enterprise Micro 5.0
An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.
ImportantCVE-2018-14550SUSE bug 1102846cpe:/o:suse:suse-microos:5.0CVE-2018-14567SUSE Linux Enterprise Micro 5.0
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
ModerateCVE-2018-14567SUSE bug 1088279SUSE bug 1088601SUSE bug 1105166cpe:/o:suse:suse-microos:5.0CVE-2018-14598SUSE Linux Enterprise Micro 5.0
An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault).
ModerateCVE-2018-14598SUSE bug 1102073cpe:/o:suse:suse-microos:5.0CVE-2018-14599SUSE Linux Enterprise Micro 5.0
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact.
ModerateCVE-2018-14599SUSE bug 1102062cpe:/o:suse:suse-microos:5.0CVE-2018-14600SUSE Linux Enterprise Micro 5.0
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution.
ImportantCVE-2018-14600SUSE bug 1102068SUSE bug 1178417cpe:/o:suse:suse-microos:5.0CVE-2018-14618SUSE Linux Enterprise Micro 5.0
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)
ModerateCVE-2018-14618SUSE bug 1106019SUSE bug 1112758SUSE bug 1122464cpe:/o:suse:suse-microos:5.0CVE-2018-14619SUSE Linux Enterprise Micro 5.0
A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This can cause the null skcipher to be freed while it is still in use leading to a local user being able to crash the system or possibly escalate privileges.
ImportantCVE-2018-14619SUSE bug 1087082SUSE bug 1106174cpe:/o:suse:suse-microos:5.0CVE-2018-14647SUSE Linux Enterprise Micro 5.0
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
ModerateCVE-2018-14647SUSE bug 1109847SUSE bug 1126909cpe:/o:suse:suse-microos:5.0CVE-2018-14679SUSE Linux Enterprise Micro 5.0
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash).
ModerateCVE-2018-14679SUSE bug 1102922SUSE bug 1103032SUSE bug 1103040cpe:/o:suse:suse-microos:5.0CVE-2018-14681SUSE Linux Enterprise Micro 5.0
An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.
ModerateCVE-2018-14681SUSE bug 1102922SUSE bug 1103032SUSE bug 1103040cpe:/o:suse:suse-microos:5.0CVE-2018-14682SUSE Linux Enterprise Micro 5.0
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.
ModerateCVE-2018-14682SUSE bug 1102922SUSE bug 1103032SUSE bug 1103040cpe:/o:suse:suse-microos:5.0CVE-2018-14722SUSE Linux Enterprise Micro 5.0
An issue was discovered in evaluate_auto_mountpoint in btrfsmaintenance-functions in btrfsmaintenance through 0.4.1. Code execution as root can occur via a specially crafted filesystem label if btrfs-{scrub,balance,trim} are set to auto in /etc/sysconfig/btrfsmaintenance (this is not the default, though).
ModerateCVE-2018-14722SUSE bug 1102721cpe:/o:suse:suse-microos:5.0CVE-2018-15120SUSE Linux Enterprise Micro 5.0
libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.
ModerateCVE-2018-15120SUSE bug 1103877cpe:/o:suse:suse-microos:5.0CVE-2018-15468SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of Service.
ModerateCVE-2018-15468SUSE bug 1103276cpe:/o:suse:suse-microos:5.0CVE-2018-15469SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest can still request v2 grant tables; they will simply not be properly set up, resulting in subsequent grant-related hypercalls hitting BUG() checks. An unprivileged guest can cause a BUG() check in the hypervisor, resulting in a denial-of-service (crash).
ModerateCVE-2018-15469SUSE bug 1103275cpe:/o:suse:suse-microos:5.0CVE-2018-15470SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of evaluation of expressions making up a tuple. As indicated in section 7.7.3 "Operations on data structures" of the OCaml manual, the order of evaluation of subexpressions is not specified. In practice, different implementations behave differently. Thus, oxenstored may not enforce the configured quota-maxentity. This allows a malicious or buggy guest to write as many xenstore entries as it wishes, causing unbounded memory usage in oxenstored. This can lead to a system-wide DoS.
ModerateCVE-2018-15470SUSE bug 1103279cpe:/o:suse:suse-microos:5.0CVE-2018-15664SUSE Linux Enterprise Micro 5.0
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).
ModerateCVE-2018-15664SUSE bug 1096726SUSE bug 1139649cpe:/o:suse:suse-microos:5.0CVE-2018-15686SUSE Linux Enterprise Micro 5.0
A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
ModerateCVE-2018-15686SUSE bug 1113665SUSE bug 1120323cpe:/o:suse:suse-microos:5.0CVE-2018-15687SUSE Linux Enterprise Micro 5.0
A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.
ModerateCVE-2018-15687SUSE bug 1113666cpe:/o:suse:suse-microos:5.0CVE-2018-15688SUSE Linux Enterprise Micro 5.0
A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239.
ImportantCVE-2018-15688SUSE bug 1113632SUSE bug 1113668SUSE bug 1113669cpe:/o:suse:suse-microos:5.0CVE-2018-15746SUSE Linux Enterprise Micro 5.0
qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread.
ModerateCVE-2018-15746SUSE bug 1106222cpe:/o:suse:suse-microos:5.0CVE-2018-15750SUSE Linux Enterprise Micro 5.0
Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.
ImportantCVE-2018-15750SUSE bug 1113698cpe:/o:suse:suse-microos:5.0CVE-2018-15751SUSE Linux Enterprise Micro 5.0
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).
CriticalCVE-2018-15751SUSE bug 1113698SUSE bug 1113699cpe:/o:suse:suse-microos:5.0CVE-2018-15853SUSE Linux Enterprise Micro 5.0
Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation.
LowCVE-2018-15853SUSE bug 1105832cpe:/o:suse:suse-microos:5.0CVE-2018-15854SUSE Linux Enterprise Micro 5.0
Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly.
LowCVE-2018-15854SUSE bug 1105832cpe:/o:suse:suse-microos:5.0CVE-2018-15855SUSE Linux Enterprise Micro 5.0
Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled.
LowCVE-2018-15855SUSE bug 1105832cpe:/o:suse:suse-microos:5.0CVE-2018-15856SUSE Linux Enterprise Micro 5.0
An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files.
LowCVE-2018-15856SUSE bug 1105832cpe:/o:suse:suse-microos:5.0CVE-2018-15857SUSE Linux Enterprise Micro 5.0
An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file.
LowCVE-2018-15857SUSE bug 1105832cpe:/o:suse:suse-microos:5.0CVE-2018-15858SUSE Linux Enterprise Micro 5.0
Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file.
LowCVE-2018-15858SUSE bug 1105832cpe:/o:suse:suse-microos:5.0CVE-2018-15859SUSE Linux Enterprise Micro 5.0
Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled.
LowCVE-2018-15859SUSE bug 1105832cpe:/o:suse:suse-microos:5.0CVE-2018-15861SUSE Linux Enterprise Micro 5.0
Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure.
LowCVE-2018-15861SUSE bug 1105832cpe:/o:suse:suse-microos:5.0CVE-2018-15862SUSE Linux Enterprise Micro 5.0
Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers.
LowCVE-2018-15862SUSE bug 1105832cpe:/o:suse:suse-microos:5.0CVE-2018-15863SUSE Linux Enterprise Micro 5.0
Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression.
LowCVE-2018-15863SUSE bug 1105832cpe:/o:suse:suse-microos:5.0CVE-2018-15864SUSE Linux Enterprise Micro 5.0
Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created.
LowCVE-2018-15864SUSE bug 1105832cpe:/o:suse:suse-microos:5.0CVE-2018-16062SUSE Linux Enterprise Micro 5.0
dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.
ModerateCVE-2018-16062SUSE bug 1106390cpe:/o:suse:suse-microos:5.0CVE-2018-16276SUSE Linux Enterprise Micro 5.0
An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges.
ImportantCVE-2018-16276SUSE bug 1106095SUSE bug 1115593cpe:/o:suse:suse-microos:5.0CVE-2018-16395SUSE Linux Enterprise Micro 5.0
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
ImportantCVE-2018-16395SUSE bug 1112530SUSE bug 1136906cpe:/o:suse:suse-microos:5.0CVE-2018-16396SUSE Linux Enterprise Micro 5.0
An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.
ModerateCVE-2018-16396SUSE bug 1112532SUSE bug 1136906cpe:/o:suse:suse-microos:5.0CVE-2018-16402SUSE Linux Enterprise Micro 5.0
libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.
ModerateCVE-2018-16402SUSE bug 1107066cpe:/o:suse:suse-microos:5.0CVE-2018-16403SUSE Linux Enterprise Micro 5.0
libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.
LowCVE-2018-16403SUSE bug 1107067cpe:/o:suse:suse-microos:5.0CVE-2018-16428SUSE Linux Enterprise Micro 5.0
In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference.
LowCVE-2018-16428SUSE bug 1107121cpe:/o:suse:suse-microos:5.0CVE-2018-16429SUSE Linux Enterprise Micro 5.0
GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str().
LowCVE-2018-16429SUSE bug 1107116cpe:/o:suse:suse-microos:5.0CVE-2018-16597SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.
ModerateCVE-2018-16597SUSE bug 1106512cpe:/o:suse:suse-microos:5.0CVE-2018-16839SUSE Linux Enterprise Micro 5.0
Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.
ModerateCVE-2018-16839SUSE bug 1112758SUSE bug 1113029SUSE bug 1131886cpe:/o:suse:suse-microos:5.0CVE-2018-16840SUSE Linux Enterprise Micro 5.0
A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.
ModerateCVE-2018-16840SUSE bug 1112758SUSE bug 1113029SUSE bug 1122464cpe:/o:suse:suse-microos:5.0CVE-2018-16842SUSE Linux Enterprise Micro 5.0
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.
ModerateCVE-2018-16842SUSE bug 1113660SUSE bug 1122464cpe:/o:suse:suse-microos:5.0CVE-2018-16846SUSE Linux Enterprise Micro 5.0
It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices.
ModerateCVE-2018-16846SUSE bug 1114710cpe:/o:suse:suse-microos:5.0CVE-2018-16847SUSE Linux Enterprise Micro 5.0
An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.
ModerateCVE-2018-16847SUSE bug 1114529SUSE bug 1114540cpe:/o:suse:suse-microos:5.0CVE-2018-16864SUSE Linux Enterprise Micro 5.0
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.
ImportantCVE-2018-16864SUSE bug 1108912SUSE bug 1120323SUSE bug 1122265SUSE bug 1188063cpe:/o:suse:suse-microos:5.0CVE-2018-16865SUSE Linux Enterprise Micro 5.0
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.
ImportantCVE-2018-16865SUSE bug 1108912SUSE bug 1120323SUSE bug 1122265SUSE bug 1188063cpe:/o:suse:suse-microos:5.0CVE-2018-16868SUSE Linux Enterprise Micro 5.0
A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.
ModerateCVE-2018-16868SUSE bug 1117951SUSE bug 1118087SUSE bug 1134856cpe:/o:suse:suse-microos:5.0CVE-2018-16869SUSE Linux Enterprise Micro 5.0
A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.
ModerateCVE-2018-16869SUSE bug 1117951SUSE bug 1118086SUSE bug 1118087SUSE bug 1134856cpe:/o:suse:suse-microos:5.0CVE-2018-16872SUSE Linux Enterprise Micro 5.0
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.
ModerateCVE-2018-16872SUSE bug 1119493SUSE bug 1119494cpe:/o:suse:suse-microos:5.0CVE-2018-16873SUSE Linux Enterprise Micro 5.0
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".
ImportantCVE-2018-16873SUSE bug 1118897SUSE bug 1118898SUSE bug 1118899cpe:/o:suse:suse-microos:5.0CVE-2018-16874SUSE Linux Enterprise Micro 5.0
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
ModerateCVE-2018-16874SUSE bug 1118897SUSE bug 1118898SUSE bug 1118899cpe:/o:suse:suse-microos:5.0CVE-2018-16875SUSE Linux Enterprise Micro 5.0
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
ModerateCVE-2018-16875SUSE bug 1118897SUSE bug 1118898SUSE bug 1118899cpe:/o:suse:suse-microos:5.0CVE-2018-16885SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and buffer length which causes the read beyond the buffer boundaries, in certain cases causing a memory access fault and a system halt by accessing invalid memory address. This issue only affects kernel version 3.10.x as shipped with Red Hat Enterprise Linux 7.
ModerateCVE-2018-16885SUSE bug 1120258cpe:/o:suse:suse-microos:5.0CVE-2018-16889SUSE Linux Enterprise Micro 5.0
Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.
ModerateCVE-2018-16889SUSE bug 1121567cpe:/o:suse:suse-microos:5.0CVE-2018-16890SUSE Linux Enterprise Micro 5.0
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.
LowCVE-2018-16890SUSE bug 1123371SUSE bug 1123378SUSE bug 1141798cpe:/o:suse:suse-microos:5.0CVE-2018-17953SUSE Linux Enterprise Micro 5.0
A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).
ImportantCVE-2018-17953SUSE bug 1115640SUSE bug 1197654cpe:/o:suse:suse-microos:5.0CVE-2018-17958SUSE Linux Enterprise Micro 5.0
Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.
ModerateCVE-2018-17958SUSE bug 1111006SUSE bug 1111007cpe:/o:suse:suse-microos:5.0CVE-2018-17962SUSE Linux Enterprise Micro 5.0
Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.
ModerateCVE-2018-17962SUSE bug 1111010SUSE bug 1111011cpe:/o:suse:suse-microos:5.0CVE-2018-17963SUSE Linux Enterprise Micro 5.0
qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.
ModerateCVE-2018-17963SUSE bug 1111013SUSE bug 1111014SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-18064SUSE Linux Enterprise Micro 5.0
cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).
ImportantCVE-2018-18064SUSE bug 1111329cpe:/o:suse:suse-microos:5.0CVE-2018-18074SUSE Linux Enterprise Micro 5.0
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
ModerateCVE-2018-18074SUSE bug 1111622cpe:/o:suse:suse-microos:5.0CVE-2018-18310SUSE Linux Enterprise Micro 5.0
An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.
LowCVE-2018-18310SUSE bug 1111973cpe:/o:suse:suse-microos:5.0CVE-2018-18311SUSE Linux Enterprise Micro 5.0
Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
ImportantCVE-2018-18311SUSE bug 1114674SUSE bug 1132018cpe:/o:suse:suse-microos:5.0CVE-2018-18312SUSE Linux Enterprise Micro 5.0
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
ModerateCVE-2018-18312SUSE bug 1114675cpe:/o:suse:suse-microos:5.0CVE-2018-18313SUSE Linux Enterprise Micro 5.0
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.
ModerateCVE-2018-18313SUSE bug 1114681cpe:/o:suse:suse-microos:5.0CVE-2018-18314SUSE Linux Enterprise Micro 5.0
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
ModerateCVE-2018-18314SUSE bug 1114686cpe:/o:suse:suse-microos:5.0CVE-2018-18438SUSE Linux Enterprise Micro 5.0
Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value.
ModerateCVE-2018-18438SUSE bug 1112185SUSE bug 1112188cpe:/o:suse:suse-microos:5.0CVE-2018-18508SUSE Linux Enterprise Micro 5.0
In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.
ModerateCVE-2018-18508SUSE bug 1124571cpe:/o:suse:suse-microos:5.0CVE-2018-18520SUSE Linux Enterprise Micro 5.0
An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.
LowCVE-2018-18520SUSE bug 1112726cpe:/o:suse:suse-microos:5.0CVE-2018-18521SUSE Linux Enterprise Micro 5.0
Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.
LowCVE-2018-18521SUSE bug 1112723cpe:/o:suse:suse-microos:5.0CVE-2018-18584SUSE Linux Enterprise Micro 5.0
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write.
ModerateCVE-2018-18584SUSE bug 1113038SUSE bug 1113039cpe:/o:suse:suse-microos:5.0CVE-2018-18585SUSE Linux Enterprise Micro 5.0
chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).
ModerateCVE-2018-18585SUSE bug 1113038SUSE bug 1113039cpe:/o:suse:suse-microos:5.0CVE-2018-18586SUSE Linux Enterprise Micro 5.0
** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application.
ModerateCVE-2018-18586SUSE bug 1113038SUSE bug 1113039SUSE bug 1113040cpe:/o:suse:suse-microos:5.0CVE-2018-18751SUSE Linux Enterprise Micro 5.0
An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related to an invalid free in po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt.
LowCVE-2018-18751SUSE bug 1113719cpe:/o:suse:suse-microos:5.0CVE-2018-18849SUSE Linux Enterprise Micro 5.0
In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.
ModerateCVE-2018-18849SUSE bug 1114422SUSE bug 1114423SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-18883SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of service (NULL pointer dereference) or possibly have unspecified other impact because nested VT-x is not properly restricted.
ModerateCVE-2018-18883SUSE bug 1114405cpe:/o:suse:suse-microos:5.0CVE-2018-19211SUSE Linux Enterprise Micro 5.0
In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.
ModerateCVE-2018-19211SUSE bug 1115929SUSE bug 1131830cpe:/o:suse:suse-microos:5.0CVE-2018-19489SUSE Linux Enterprise Micro 5.0
v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.
LowCVE-2018-19489SUSE bug 1117275SUSE bug 1117279cpe:/o:suse:suse-microos:5.0CVE-2018-19637SUSE Linux Enterprise Micro 5.0
Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection
ImportantCVE-2018-19637SUSE bug 1063385SUSE bug 1117776cpe:/o:suse:suse-microos:5.0CVE-2018-19638SUSE Linux Enterprise Micro 5.0
In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.
LowCVE-2018-19638SUSE bug 1063385SUSE bug 1118460SUSE bug 1118462SUSE bug 1118463cpe:/o:suse:suse-microos:5.0CVE-2018-19639SUSE Linux Enterprise Micro 5.0
If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.
ImportantCVE-2018-19639SUSE bug 1063385SUSE bug 1118460SUSE bug 1118462cpe:/o:suse:suse-microos:5.0CVE-2018-19640SUSE Linux Enterprise Micro 5.0
If the attacker manages to create files in the directory used to collect log files in supportutils before version 3.1-5.7.1 (e.g. with CVE-2018-19638) he can kill arbitrary processes on the local machine.
ModerateCVE-2018-19640SUSE bug 1063385SUSE bug 1118463cpe:/o:suse:suse-microos:5.0CVE-2018-19788SUSE Linux Enterprise Micro 5.0
A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command.
ModerateCVE-2018-19788SUSE bug 1118274SUSE bug 1118277SUSE bug 1119056SUSE bug 1126909cpe:/o:suse:suse-microos:5.0CVE-2018-19961SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.
ImportantCVE-2018-19961SUSE bug 1115040SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-19962SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.
ImportantCVE-2018-19962SUSE bug 1115040SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-19963SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because x86 IOREQ server resource accounting (for external emulators) was mishandled.
ImportantCVE-2018-19963SUSE bug 1115043cpe:/o:suse:suse-microos:5.0CVE-2018-19964SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a denial of service (host OS hang) because the p2m lock remains unavailable indefinitely in certain error conditions.
ModerateCVE-2018-19964SUSE bug 1115044cpe:/o:suse:suse-microos:5.0CVE-2018-19965SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.
ModerateCVE-2018-19965SUSE bug 1115045cpe:/o:suse:suse-microos:5.0CVE-2018-19966SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for CVE-2017-15595.
ModerateCVE-2018-19966SUSE bug 1115047SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-19967SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.11.x on Intel x86 platforms allowing guest OS users to cause a denial of service (host OS hang) because Xen does not work around Intel's mishandling of certain HLE transactions associated with the KACQUIRE instruction prefix.
ModerateCVE-2018-19967SUSE bug 1114988SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-20123SUSE Linux Enterprise Micro 5.0
pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.
LowCVE-2018-20123SUSE bug 1119437SUSE bug 1119438cpe:/o:suse:suse-microos:5.0CVE-2018-20124SUSE Linux Enterprise Micro 5.0
hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.
ModerateCVE-2018-20124SUSE bug 1119840SUSE bug 1119841cpe:/o:suse:suse-microos:5.0CVE-2018-20125SUSE Linux Enterprise Micro 5.0
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings.
ImportantCVE-2018-20125SUSE bug 1119989cpe:/o:suse:suse-microos:5.0CVE-2018-20126SUSE Linux Enterprise Micro 5.0
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled.
LowCVE-2018-20126SUSE bug 1119991cpe:/o:suse:suse-microos:5.0CVE-2018-20191SUSE Linux Enterprise Micro 5.0
hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of service (NULL pointer dereference).
ImportantCVE-2018-20191SUSE bug 1119979SUSE bug 1119980cpe:/o:suse:suse-microos:5.0CVE-2018-20216SUSE Linux Enterprise Micro 5.0
QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled).
ImportantCVE-2018-20216SUSE bug 1119984SUSE bug 1119985cpe:/o:suse:suse-microos:5.0CVE-2018-20217SUSE Linux Enterprise Micro 5.0
A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.
ModerateCVE-2018-20217SUSE bug 1120489cpe:/o:suse:suse-microos:5.0CVE-2018-20346SUSE Linux Enterprise Micro 5.0
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.
ImportantCVE-2018-20346SUSE bug 1119687SUSE bug 1120335SUSE bug 1131576SUSE bug 1131918SUSE bug 1131919SUSE bug 1148893SUSE bug 1169664cpe:/o:suse:suse-microos:5.0CVE-2018-20406SUSE Linux Enterprise Micro 5.0
Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
LowCVE-2018-20406SUSE bug 1120644cpe:/o:suse:suse-microos:5.0CVE-2018-20482SUSE Linux Enterprise Micro 5.0
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).
ModerateCVE-2018-20482SUSE bug 1120610cpe:/o:suse:suse-microos:5.0CVE-2018-20511SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers/net/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call.
LowCVE-2018-20511SUSE bug 1120388cpe:/o:suse:suse-microos:5.0CVE-2018-20532SUSE Linux Enterprise Micro 5.0
There is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service.
ModerateCVE-2018-20532SUSE bug 1120629cpe:/o:suse:suse-microos:5.0CVE-2018-20533SUSE Linux Enterprise Micro 5.0
There is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service.
ModerateCVE-2018-20533SUSE bug 1120630cpe:/o:suse:suse-microos:5.0CVE-2018-20534SUSE Linux Enterprise Micro 5.0
** DISPUTED ** There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any real-world application.
LowCVE-2018-20534SUSE bug 1120631cpe:/o:suse:suse-microos:5.0CVE-2018-20573SUSE Linux Enterprise Micro 5.0
The Scanner::EnsureTokensInQueue function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
ModerateCVE-2018-20573SUSE bug 1121227cpe:/o:suse:suse-microos:5.0CVE-2018-20574SUSE Linux Enterprise Micro 5.0
The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
ModerateCVE-2018-20574SUSE bug 1121230cpe:/o:suse:suse-microos:5.0CVE-2018-20669SUSE Linux Enterprise Micro 5.0
An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation.
ImportantCVE-2018-20669SUSE bug 1122971cpe:/o:suse:suse-microos:5.0CVE-2018-20685SUSE Linux Enterprise Micro 5.0
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
ImportantCVE-2018-20685SUSE bug 1121571SUSE bug 1123220SUSE bug 1131109SUSE bug 1134932cpe:/o:suse:suse-microos:5.0CVE-2018-20699SUSE Linux Enterprise Micro 5.0
Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.
ModerateCVE-2018-20699SUSE bug 1121768cpe:/o:suse:suse-microos:5.0CVE-2018-20784SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load.
ModerateCVE-2018-20784SUSE bug 1126703cpe:/o:suse:suse-microos:5.0CVE-2018-20796SUSE Linux Enterprise Micro 5.0
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
ModerateCVE-2018-20796SUSE bug 1127311SUSE bug 1182116cpe:/o:suse:suse-microos:5.0CVE-2018-20815SUSE Linux Enterprise Micro 5.0
In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.
ModerateCVE-2018-20815SUSE bug 1118900SUSE bug 1130675SUSE bug 1130680SUSE bug 1138043SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-20843SUSE Linux Enterprise Micro 5.0
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
ModerateCVE-2018-20843SUSE bug 1139937cpe:/o:suse:suse-microos:5.0CVE-2018-20852SUSE Linux Enterprise Micro 5.0
http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.
ModerateCVE-2018-20852SUSE bug 1141853cpe:/o:suse:suse-microos:5.0CVE-2018-20854SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 4.20. drivers/phy/mscc/phy-ocelot-serdes.c has an off-by-one error with a resultant ctrl->phys out-of-bounds read.
ImportantCVE-2018-20854SUSE bug 1143038cpe:/o:suse:suse-microos:5.0CVE-2018-21029SUSE Linux Enterprise Micro 5.0
** DISPUTED ** systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent).
CriticalCVE-2018-21029SUSE bug 1155539cpe:/o:suse:suse-microos:5.0CVE-2018-25015SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 4.14.16. There is a use-after-free in net/sctp/socket.c for a held lock after a peel off, aka CID-a0ff660058b8.
ImportantCVE-2018-25015SUSE bug 1187046cpe:/o:suse:suse-microos:5.0CVE-2018-25032SUSE Linux Enterprise Micro 5.0
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
ImportantCVE-2018-25032SUSE bug 1197459SUSE bug 1197893SUSE bug 1198667SUSE bug 1199104SUSE bug 1200049SUSE bug 1201732SUSE bug 1202688cpe:/o:suse:suse-microos:5.0CVE-2018-3639SUSE Linux Enterprise Micro 5.0
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.
ModerateCVE-2018-3639SUSE bug 1074701SUSE bug 1085235SUSE bug 1085308SUSE bug 1087078SUSE bug 1087082SUSE bug 1092631SUSE bug 1092885SUSE bug 1094912SUSE bug 1098813SUSE bug 1100394SUSE bug 1102640SUSE bug 1105412SUSE bug 1111963SUSE bug 1172781SUSE bug 1172782SUSE bug 1172783SUSE bug 1173489SUSE bug 1178658SUSE bug 1201877SUSE bug 1215674cpe:/o:suse:suse-microos:5.0CVE-2018-3640SUSE Linux Enterprise Micro 5.0
Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a.
ModerateCVE-2018-3640SUSE bug 1074701SUSE bug 1087078SUSE bug 1087083SUSE bug 1094912SUSE bug 1098813SUSE bug 1100394SUSE bug 1115893SUSE bug 1175912SUSE bug 1201877cpe:/o:suse:suse-microos:5.0CVE-2018-3646SUSE Linux Enterprise Micro 5.0
Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis.
ImportantCVE-2018-3646SUSE bug 1087078SUSE bug 1087081SUSE bug 1089343SUSE bug 1091107SUSE bug 1099306SUSE bug 1104365SUSE bug 1104894SUSE bug 1106548SUSE bug 1113534SUSE bug 1136865SUSE bug 1178658SUSE bug 1201877cpe:/o:suse:suse-microos:5.0CVE-2018-3665SUSE Linux Enterprise Micro 5.0
System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel.
ModerateCVE-2018-3665SUSE bug 1087078SUSE bug 1087082SUSE bug 1087086SUSE bug 1090338SUSE bug 1095241SUSE bug 1095242SUSE bug 1096740SUSE bug 1100091SUSE bug 1100555SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-5146SUSE Linux Enterprise Micro 5.0
An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7.
ImportantCVE-2018-5146SUSE bug 1085671SUSE bug 1085687SUSE bug 1180395cpe:/o:suse:suse-microos:5.0CVE-2018-5244SUSE Linux Enterprise Micro 5.0
In Xen 4.10, new infrastructure was introduced as part of an overhaul to how MSR emulation happens for guests. Unfortunately, one tracking structure isn't freed when a vcpu is destroyed. This allows guest OS administrators to cause a denial of service (host OS memory consumption) by rebooting many times.
LowCVE-2018-5244SUSE bug 1073961SUSE bug 1074966cpe:/o:suse:suse-microos:5.0CVE-2018-5344SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified other impact.
ModerateCVE-2018-5344SUSE bug 1075825SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2018-5703SUSE Linux Enterprise Micro 5.0
The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.14.11 allows attackers to cause a denial of service (slab out-of-bounds write) or possibly have unspecified other impact via vectors involving TLS.
ImportantCVE-2018-5703SUSE bug 1076200cpe:/o:suse:suse-microos:5.0CVE-2018-5729SUSE Linux Enterprise Micro 5.0
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.
ModerateCVE-2018-5729SUSE bug 1076211SUSE bug 1083926SUSE bug 1122468cpe:/o:suse:suse-microos:5.0CVE-2018-5730SUSE Linux Enterprise Micro 5.0
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN.
ModerateCVE-2018-5730SUSE bug 1076211SUSE bug 1083927SUSE bug 1122468cpe:/o:suse:suse-microos:5.0CVE-2018-5748SUSE Linux Enterprise Micro 5.0
qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply.
LowCVE-2018-5748SUSE bug 1076500SUSE bug 1083625SUSE bug 1087887cpe:/o:suse:suse-microos:5.0CVE-2018-5764SUSE Linux Enterprise Micro 5.0
The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.
LowCVE-2018-5764SUSE bug 1076503cpe:/o:suse:suse-microos:5.0CVE-2018-6003SUSE Linux Enterprise Micro 5.0
An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.
ImportantCVE-2018-6003SUSE bug 1076832cpe:/o:suse:suse-microos:5.0CVE-2018-6485SUSE Linux Enterprise Micro 5.0
An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.
ModerateCVE-2018-6485SUSE bug 1079036SUSE bug 1123874cpe:/o:suse:suse-microos:5.0CVE-2018-6551SUSE Linux Enterprise Micro 5.0
The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.
ModerateCVE-2018-6551SUSE bug 1079036cpe:/o:suse:suse-microos:5.0CVE-2018-6829SUSE Linux Enterprise Micro 5.0
cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.
ModerateCVE-2018-6829SUSE bug 1081684cpe:/o:suse:suse-microos:5.0CVE-2018-6914SUSE Linux Enterprise Micro 5.0
Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.
LowCVE-2018-6914SUSE bug 1087441SUSE bug 1136906cpe:/o:suse:suse-microos:5.0CVE-2018-6942SUSE Linux Enterprise Micro 5.0
An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file.
ModerateCVE-2018-6942cpe:/o:suse:suse-microos:5.0CVE-2018-6954SUSE Linux Enterprise Micro 5.0
systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.
ImportantCVE-2018-6954SUSE bug 1080919cpe:/o:suse:suse-microos:5.0CVE-2018-7169SUSE Linux Enterprise Micro 5.0
An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.
ModerateCVE-2018-7169SUSE bug 1081294cpe:/o:suse:suse-microos:5.0CVE-2018-7480SUSE Linux Enterprise Micro 5.0
The blkcg_init_queue function in block/blk-cgroup.c in the Linux kernel before 4.11 allows local users to cause a denial of service (double free) or possibly have unspecified other impact by triggering a creation failure.
ModerateCVE-2018-7480SUSE bug 1082863SUSE bug 1084536cpe:/o:suse:suse-microos:5.0CVE-2018-7540SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (host OS CPU hang) via non-preemptable L3/L4 pagetable freeing.
ModerateCVE-2018-7540SUSE bug 1080635SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-7541SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.10.x allowing guest OS users to cause a denial of service (hypervisor crash) or gain privileges by triggering a grant-table transition from v2 to v1.
ImportantCVE-2018-7541SUSE bug 1080662SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-7542SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen 4.8.x through 4.10.x allowing x86 PVH guest OS users to cause a denial of service (NULL pointer dereference and hypervisor crash) by leveraging the mishandling of configurations that lack a Local APIC.
ImportantCVE-2018-7542SUSE bug 1080634cpe:/o:suse:suse-microos:5.0CVE-2018-7550SUSE Linux Enterprise Micro 5.0
The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access.
ImportantCVE-2018-7550SUSE bug 1083291SUSE bug 1083292cpe:/o:suse:suse-microos:5.0CVE-2018-7685SUSE Linux Enterprise Micro 5.0
The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.
ImportantCVE-2018-7685SUSE bug 1045735SUSE bug 1088705SUSE bug 1091624cpe:/o:suse:suse-microos:5.0CVE-2018-7738SUSE Linux Enterprise Micro 5.0
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.
ImportantCVE-2018-7738SUSE bug 1080740SUSE bug 1084300SUSE bug 1213865cpe:/o:suse:suse-microos:5.0CVE-2018-7858SUSE Linux Enterprise Micro 5.0
Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.
ModerateCVE-2018-7858SUSE bug 1084604cpe:/o:suse:suse-microos:5.0CVE-2018-7995SUSE Linux Enterprise Micro 5.0
** DISPUTED ** Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck<cpu number> directory. NOTE: a third party has indicated that this report is not security relevant.
ModerateCVE-2018-7995SUSE bug 1084755SUSE bug 1087082cpe:/o:suse:suse-microos:5.0CVE-2018-7999SUSE Linux Enterprise Micro 5.0
In libgraphite2 in graphite2 1.3.11, a NULL pointer dereference vulnerability was found in Segment.cpp during a dumbRendering operation, which may allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .ttf file.
ModerateCVE-2018-7999SUSE bug 1084850cpe:/o:suse:suse-microos:5.0CVE-2018-8740SUSE Linux Enterprise Micro 5.0
In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.
LowCVE-2018-8740SUSE bug 1085790SUSE bug 1131919cpe:/o:suse:suse-microos:5.0CVE-2018-8769SUSE Linux Enterprise Micro 5.0
elfutils 0.170 has a buffer over-read in the ebl_dynamic_tag_name function of libebl/ebldynamictagname.c because SYMTAB_SHNDX is unsupported.
ModerateCVE-2018-8769SUSE bug 1085809cpe:/o:suse:suse-microos:5.0CVE-2018-8777SUSE Linux Enterprise Micro 5.0
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).
ImportantCVE-2018-8777SUSE bug 1087436SUSE bug 1136906cpe:/o:suse:suse-microos:5.0CVE-2018-8778SUSE Linux Enterprise Micro 5.0
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.
ModerateCVE-2018-8778SUSE bug 1087433SUSE bug 1136906cpe:/o:suse:suse-microos:5.0CVE-2018-8779SUSE Linux Enterprise Micro 5.0
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket.
LowCVE-2018-8779SUSE bug 1087440SUSE bug 1136906cpe:/o:suse:suse-microos:5.0CVE-2018-8780SUSE Linux Enterprise Micro 5.0
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.
LowCVE-2018-8780SUSE bug 1087437SUSE bug 1136906cpe:/o:suse:suse-microos:5.0CVE-2018-8897SUSE Linux Enterprise Micro 5.0
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.
ImportantCVE-2018-8897SUSE bug 1087078SUSE bug 1087088SUSE bug 1090368SUSE bug 1090820SUSE bug 1090869SUSE bug 1092497SUSE bug 1093522SUSE bug 1093524SUSE bug 1098813SUSE bug 1100835SUSE bug 1115893SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2018-9056SUSE Linux Enterprise Micro 5.0
Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user access via a side-channel attack on the directional branch predictor, as demonstrated by a pattern history table (PHT), aka BranchScope.
ModerateCVE-2018-9056SUSE bug 1087110cpe:/o:suse:suse-microos:5.0CVE-2018-9234SUSE Linux Enterprise Micro 5.0
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.
ImportantCVE-2018-9234SUSE bug 1088255SUSE bug 1090647cpe:/o:suse:suse-microos:5.0CVE-2018-9251SUSE Linux Enterprise Micro 5.0
The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.
LowCVE-2018-9251SUSE bug 1088279SUSE bug 1088601SUSE bug 1105166cpe:/o:suse:suse-microos:5.0CVE-2019-0154SUSE Linux Enterprise Micro 5.0
Insufficient access control in subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100 Processor Families may allow an authenticated user to potentially enable denial of service via local access.
ImportantCVE-2019-0154SUSE bug 1135966SUSE bug 1181720cpe:/o:suse:suse-microos:5.0CVE-2019-0155SUSE Linux Enterprise Micro 5.0
Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and E-2200 Processor Families; Intel(R) Graphics Driver for Windows before 26.20.100.6813 (DCH) or 26.20.100.6812 and before 21.20.x.5077 (aka15.45.5077), i915 Linux Driver for Intel(R) Processor Graphics before versions 5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, 4.4.201 may allow an authenticated user to potentially enable escalation of privilege via local access.
ImportantCVE-2019-0155SUSE bug 1135966SUSE bug 1135967SUSE bug 1173663cpe:/o:suse:suse-microos:5.0CVE-2019-1010305SUSE Linux Enterprise Micro 5.0
libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.
LowCVE-2019-1010305SUSE bug 1141680cpe:/o:suse:suse-microos:5.0CVE-2019-10125SUSE Linux Enterprise Micro 5.0
An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expected event is triggered immediately (e.g., by the close of a pair of pipes) after the return of vfs_poll(), and this will cause a use-after-free.
CriticalCVE-2019-10125SUSE bug 1130695cpe:/o:suse:suse-microos:5.0CVE-2019-10132SUSE Linux Enterprise Micro 5.0
A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.
ImportantCVE-2019-10132SUSE bug 1134348cpe:/o:suse:suse-microos:5.0CVE-2019-10140SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local access can create a denial of service situation via NULL pointer dereference in ovl_posix_acl_create function in fs/overlayfs/dir.c. This can allow attackers with ability to create directories on overlayfs to crash the kernel creating a denial of service (DOS).
ModerateCVE-2019-10140SUSE bug 1145701cpe:/o:suse:suse-microos:5.0CVE-2019-10142SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw to crash the system, corrupt memory, or create other adverse security affects.
ImportantCVE-2019-10142SUSE bug 1135955cpe:/o:suse:suse-microos:5.0CVE-2019-10152SUSE Linux Enterprise Micro 5.0
A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.
ImportantCVE-2019-10152SUSE bug 1136974cpe:/o:suse:suse-microos:5.0CVE-2019-10160SUSE Linux Enterprise Micro 5.0
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
CriticalCVE-2019-10160SUSE bug 1138459cpe:/o:suse:suse-microos:5.0CVE-2019-10161SUSE Linux Enterprise Micro 5.0
It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.
ImportantCVE-2019-10161SUSE bug 1138301cpe:/o:suse:suse-microos:5.0CVE-2019-10166SUSE Linux Enterprise Micro 5.0
It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.
ImportantCVE-2019-10166SUSE bug 1138302cpe:/o:suse:suse-microos:5.0CVE-2019-10167SUSE Linux Enterprise Micro 5.0
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
ImportantCVE-2019-10167SUSE bug 1138303cpe:/o:suse:suse-microos:5.0CVE-2019-10168SUSE Linux Enterprise Micro 5.0
The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
ImportantCVE-2019-10168SUSE bug 1138305SUSE bug 1138582cpe:/o:suse:suse-microos:5.0CVE-2019-10214SUSE Linux Enterprise Micro 5.0
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.
ImportantCVE-2019-10214SUSE bug 1144065cpe:/o:suse:suse-microos:5.0CVE-2019-10220SUSE Linux Enterprise Micro 5.0
Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.
ImportantCVE-2019-10220SUSE bug 1144903SUSE bug 1153108cpe:/o:suse:suse-microos:5.0CVE-2019-10557SUSE Linux Enterprise Micro 5.0
Out-of-bound read in the wireless driver in the Linux kernel due to lack of check of buffer length. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8009, APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS605, SDA660, SDA845, SDM630, SDM636, SDM660, SDX20, SDX55, SXR1130
CriticalCVE-2019-10557SUSE bug 1159621cpe:/o:suse:suse-microos:5.0CVE-2019-10906SUSE Linux Enterprise Micro 5.0
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
ImportantCVE-2019-10906SUSE bug 1132323cpe:/o:suse:suse-microos:5.0CVE-2019-11068SUSE Linux Enterprise Micro 5.0
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
ModerateCVE-2019-11068SUSE bug 1132160SUSE bug 1154212cpe:/o:suse:suse-microos:5.0CVE-2019-11091SUSE Linux Enterprise Micro 5.0
Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
ModerateCVE-2019-11091SUSE bug 1103186SUSE bug 1111331SUSE bug 1132686SUSE bug 1133319SUSE bug 1135394SUSE bug 1138043SUSE bug 1138534SUSE bug 1141977SUSE bug 1178658SUSE bug 1201877cpe:/o:suse:suse-microos:5.0CVE-2019-11135SUSE Linux Enterprise Micro 5.0
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
ModerateCVE-2019-11135SUSE bug 1139073SUSE bug 1152497SUSE bug 1152505SUSE bug 1152506SUSE bug 1160120SUSE bug 1201877cpe:/o:suse:suse-microos:5.0CVE-2019-11139SUSE Linux Enterprise Micro 5.0
Improper conditions check in the voltage modulation interface for some Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable denial of service via local access.
ModerateCVE-2019-11139SUSE bug 1141035cpe:/o:suse:suse-microos:5.0CVE-2019-11236SUSE Linux Enterprise Micro 5.0
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
ModerateCVE-2019-11236SUSE bug 1129071SUSE bug 1132663cpe:/o:suse:suse-microos:5.0CVE-2019-11324SUSE Linux Enterprise Micro 5.0
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
LowCVE-2019-11324SUSE bug 1132900cpe:/o:suse:suse-microos:5.0CVE-2019-11477SUSE Linux Enterprise Micro 5.0
Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.
ImportantCVE-2019-11477SUSE bug 1132686SUSE bug 1137586SUSE bug 1142129SUSE bug 1153242cpe:/o:suse:suse-microos:5.0CVE-2019-11478SUSE Linux Enterprise Micro 5.0
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.
ImportantCVE-2019-11478SUSE bug 1132686SUSE bug 1137586SUSE bug 1142129SUSE bug 1143542cpe:/o:suse:suse-microos:5.0CVE-2019-11479SUSE Linux Enterprise Micro 5.0
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.
ImportantCVE-2019-11479SUSE bug 1132686SUSE bug 1137586SUSE bug 1142129SUSE bug 1143542cpe:/o:suse:suse-microos:5.0CVE-2019-11555SUSE Linux Enterprise Micro 5.0
The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c.
ModerateCVE-2019-11555SUSE bug 1133640cpe:/o:suse:suse-microos:5.0CVE-2019-11683SUSE Linux Enterprise Micro 5.0
udp_gro_receive_segment in net/ipv4/udp_offload.c in the Linux kernel 5.x before 5.0.13 allows remote attackers to cause a denial of service (slab-out-of-bounds memory corruption) or possibly have unspecified other impact via UDP packets with a 0 payload, because of mishandling of padded packets, aka the "GRO packet of death" issue.
ImportantCVE-2019-11683SUSE bug 1134021cpe:/o:suse:suse-microos:5.0CVE-2019-11745SUSE Linux Enterprise Micro 5.0
When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
ImportantCVE-2019-11745SUSE bug 1158328SUSE bug 1158527cpe:/o:suse:suse-microos:5.0CVE-2019-11922SUSE Linux Enterprise Micro 5.0
A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
LowCVE-2019-11922SUSE bug 1142941cpe:/o:suse:suse-microos:5.0CVE-2019-12067SUSE Linux Enterprise Micro 5.0
The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is null.
LowCVE-2019-12067SUSE bug 1145642SUSE bug 1145652cpe:/o:suse:suse-microos:5.0CVE-2019-12068SUSE Linux Enterprise Micro 5.0
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
ModerateCVE-2019-12068SUSE bug 1146873SUSE bug 1146874SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2019-12155SUSE Linux Enterprise Micro 5.0
interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
LowCVE-2019-12155SUSE bug 1135902SUSE bug 1135905cpe:/o:suse:suse-microos:5.0CVE-2019-12290SUSE Linux Enterprise Micro 5.0
GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.
ModerateCVE-2019-12290SUSE bug 1154884cpe:/o:suse:suse-microos:5.0CVE-2019-12378SUSE Linux Enterprise Micro 5.0
** DISPUTED ** An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: This has been disputed as not an issue.
LowCVE-2019-12378SUSE bug 1136588cpe:/o:suse:suse-microos:5.0CVE-2019-12379SUSE Linux Enterprise Micro 5.0
** DISPUTED ** An issue was discovered in con_insert_unipair in drivers/tty/vt/consolemap.c in the Linux kernel through 5.1.5. There is a memory leak in a certain case of an ENOMEM outcome of kmalloc. NOTE: This id is disputed as not being an issue.
LowCVE-2019-12379SUSE bug 1136602cpe:/o:suse:suse-microos:5.0CVE-2019-12381SUSE Linux Enterprise Micro 5.0
** DISPUTED ** An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: this is disputed because new_ra is never used if it is NULL.
LowCVE-2019-12381SUSE bug 1136593cpe:/o:suse:suse-microos:5.0CVE-2019-12450SUSE Linux Enterprise Micro 5.0
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
ImportantCVE-2019-12450SUSE bug 1137001SUSE bug 1139959SUSE bug 1142126cpe:/o:suse:suse-microos:5.0CVE-2019-12454SUSE Linux Enterprise Micro 5.0
** DISPUTED ** An issue was discovered in wcd9335_codec_enable_dec in sound/soc/codecs/wcd9335.c in the Linux kernel through 5.1.5. It uses kstrndup instead of kmemdup_nul, which allows attackers to have an unspecified impact via unknown vectors. NOTE: The vendor disputes this issues as not being a vulnerability because switching to kmemdup_nul() would only fix a security issue if the source string wasn't NUL-terminated, which is not the case.
ImportantCVE-2019-12454SUSE bug 1136963cpe:/o:suse:suse-microos:5.0CVE-2019-12455SUSE Linux Enterprise Micro 5.0
** DISPUTED ** An issue was discovered in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c in the Linux kernel through 5.1.5. There is an unchecked kstrndup of derived_name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: This id is disputed as not being an issue because “The memory allocation that was not checked is part of a code that only runs at boot time, before user processes are started. Therefore, there is no possibility for an unprivileged user to control it, and no denial of service.”.
ModerateCVE-2019-12455SUSE bug 1136946cpe:/o:suse:suse-microos:5.0CVE-2019-12615SUSE Linux Enterprise Micro 5.0
An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup_const of node_info->vdev_port.name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).
ModerateCVE-2019-12615SUSE bug 1137195cpe:/o:suse:suse-microos:5.0CVE-2019-12735SUSE Linux Enterprise Micro 5.0
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.
ImportantCVE-2019-12735SUSE bug 1137443cpe:/o:suse:suse-microos:5.0CVE-2019-12749SUSE Linux Enterprise Micro 5.0
dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.
ImportantCVE-2019-12749SUSE bug 1137832cpe:/o:suse:suse-microos:5.0CVE-2019-12900SUSE Linux Enterprise Micro 5.0
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
ImportantCVE-2019-12900SUSE bug 1139083SUSE bug 1141513SUSE bug 1149458cpe:/o:suse:suse-microos:5.0CVE-2019-12904SUSE Linux Enterprise Micro 5.0
** DISPUTED ** In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack.
ModerateCVE-2019-12904SUSE bug 1138939cpe:/o:suse:suse-microos:5.0CVE-2019-13050SUSE Linux Enterprise Micro 5.0
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
ModerateCVE-2019-13050SUSE bug 1141093cpe:/o:suse:suse-microos:5.0CVE-2019-13057SUSE Linux Enterprise Micro 5.0
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
ModerateCVE-2019-13057SUSE bug 1143273cpe:/o:suse:suse-microos:5.0CVE-2019-13115SUSE Linux Enterprise Micro 5.0
In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.
ModerateCVE-2019-13115SUSE bug 1141850cpe:/o:suse:suse-microos:5.0CVE-2019-13117SUSE Linux Enterprise Micro 5.0
In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
ModerateCVE-2019-13117SUSE bug 1140095SUSE bug 1157028SUSE bug 1160968cpe:/o:suse:suse-microos:5.0CVE-2019-13118SUSE Linux Enterprise Micro 5.0
In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.
LowCVE-2019-13118SUSE bug 1140101SUSE bug 1157028SUSE bug 1160968cpe:/o:suse:suse-microos:5.0CVE-2019-13132SUSE Linux Enterprise Micro 5.0
In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.
ImportantCVE-2019-13132SUSE bug 1140255cpe:/o:suse:suse-microos:5.0CVE-2019-13164SUSE Linux Enterprise Micro 5.0
qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
ModerateCVE-2019-13164SUSE bug 1140402cpe:/o:suse:suse-microos:5.0CVE-2019-13377SUSE Linux Enterprise Micro 5.0
The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are used. An attacker may be able to gain leaked information from a side-channel attack that can be used for full password recovery.
ModerateCVE-2019-13377SUSE bug 1144443cpe:/o:suse:suse-microos:5.0CVE-2019-13509SUSE Linux Enterprise Micro 5.0
In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.
ModerateCVE-2019-13509SUSE bug 1142160cpe:/o:suse:suse-microos:5.0CVE-2019-13565SUSE Linux Enterprise Micro 5.0
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.
ModerateCVE-2019-13565SUSE bug 1143194cpe:/o:suse:suse-microos:5.0CVE-2019-13627SUSE Linux Enterprise Micro 5.0
It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
ModerateCVE-2019-13627SUSE bug 1148987cpe:/o:suse:suse-microos:5.0CVE-2019-14271SUSE Linux Enterprise Micro 5.0
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
ImportantCVE-2019-14271SUSE bug 1143409cpe:/o:suse:suse-microos:5.0CVE-2019-14287SUSE Linux Enterprise Micro 5.0
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
ModerateCVE-2019-14287SUSE bug 1153674SUSE bug 1156093cpe:/o:suse:suse-microos:5.0CVE-2019-14378SUSE Linux Enterprise Micro 5.0
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
ImportantCVE-2019-14378SUSE bug 1143794SUSE bug 1143797SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2019-14513SUSE Linux Enterprise Micro 5.0
Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491.
ModerateCVE-2019-14513SUSE bug 1143944cpe:/o:suse:suse-microos:5.0CVE-2019-14615SUSE Linux Enterprise Micro 5.0
Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may allow an unauthenticated user to potentially enable information disclosure via local access.
ModerateCVE-2019-14615SUSE bug 1160195SUSE bug 1165881cpe:/o:suse:suse-microos:5.0CVE-2019-14763SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/gadget.c may potentially cause a deadlock with f_hid.
ModerateCVE-2019-14763SUSE bug 1144918cpe:/o:suse:suse-microos:5.0CVE-2019-14814SUSE Linux Enterprise Micro 5.0
There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.
ImportantCVE-2019-14814SUSE bug 1146512SUSE bug 1173664SUSE bug 1173665cpe:/o:suse:suse-microos:5.0CVE-2019-14815SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marvell Wifi Driver.
ImportantCVE-2019-14815SUSE bug 1146514SUSE bug 1173665cpe:/o:suse:suse-microos:5.0CVE-2019-14816SUSE Linux Enterprise Micro 5.0
There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.
ImportantCVE-2019-14816SUSE bug 1146516SUSE bug 1173666cpe:/o:suse:suse-microos:5.0CVE-2019-14866SUSE Linux Enterprise Micro 5.0
In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.
ModerateCVE-2019-14866SUSE bug 1155199cpe:/o:suse:suse-microos:5.0CVE-2019-14889SUSE Linux Enterprise Micro 5.0
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.
ImportantCVE-2019-14889SUSE bug 1158095cpe:/o:suse:suse-microos:5.0CVE-2019-14895SUSE Linux Enterprise Micro 5.0
A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code.
ImportantCVE-2019-14895SUSE bug 1157042SUSE bug 1157158SUSE bug 1173100SUSE bug 1173660cpe:/o:suse:suse-microos:5.0CVE-2019-14896SUSE Linux Enterprise Micro 5.0
A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP.
ImportantCVE-2019-14896SUSE bug 1157157SUSE bug 1160468cpe:/o:suse:suse-microos:5.0CVE-2019-14897SUSE Linux Enterprise Micro 5.0
A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and connects to another STA.
ImportantCVE-2019-14897SUSE bug 1157155SUSE bug 1160467SUSE bug 1160468cpe:/o:suse:suse-microos:5.0CVE-2019-14898SUSE Linux Enterprise Micro 5.0
The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive information, cause a denial of service, or possibly have other unspecified impacts by triggering a race condition with mmget_not_zero or get_task_mm calls.
ModerateCVE-2019-14898SUSE bug 1157905cpe:/o:suse:suse-microos:5.0CVE-2019-14901SUSE Linux Enterprise Micro 5.0
A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system.
ImportantCVE-2019-14901SUSE bug 1157042SUSE bug 1173661cpe:/o:suse:suse-microos:5.0CVE-2019-15030SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check.
ModerateCVE-2019-15030SUSE bug 1149713cpe:/o:suse:suse-microos:5.0CVE-2019-15031SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process, because MSR_TM_ACTIVE is misused in arch/powerpc/kernel/process.c.
ModerateCVE-2019-15031SUSE bug 1149713cpe:/o:suse:suse-microos:5.0CVE-2019-15098SUSE Linux Enterprise Micro 5.0
drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.
ModerateCVE-2019-15098SUSE bug 1146378SUSE bug 1146543cpe:/o:suse:suse-microos:5.0CVE-2019-15099SUSE Linux Enterprise Micro 5.0
drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.
ModerateCVE-2019-15099SUSE bug 1146368cpe:/o:suse:suse-microos:5.0CVE-2019-15126SUSE Linux Enterprise Micro 5.0
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.
ImportantCVE-2019-15126SUSE bug 1167162cpe:/o:suse:suse-microos:5.0CVE-2019-15223SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c driver.
ModerateCVE-2019-15223SUSE bug 1146519SUSE bug 1146535SUSE bug 1158381SUSE bug 1158834cpe:/o:suse:suse-microos:5.0CVE-2019-15290SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-15098. Reason: This candidate is a duplicate of CVE-2019-15098. Notes: All CVE users should reference CVE-2019-15098 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
ModerateCVE-2019-15290SUSE bug 1146378SUSE bug 1146519SUSE bug 1146543SUSE bug 1158381SUSE bug 1158834cpe:/o:suse:suse-microos:5.0CVE-2019-15291SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver.
ModerateCVE-2019-15291SUSE bug 1146519SUSE bug 1146540SUSE bug 1158381SUSE bug 1158834cpe:/o:suse:suse-microos:5.0CVE-2019-1543SUSE Linux Enterprise Micro 5.0
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).
LowCVE-2019-1543SUSE bug 1128189SUSE bug 1141801SUSE bug 1154162cpe:/o:suse:suse-microos:5.0CVE-2019-1547SUSE Linux Enterprise Micro 5.0
Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
ModerateCVE-2019-1547SUSE bug 1150003SUSE bug 1154162SUSE bug 1154166SUSE bug 1156430SUSE bug 1161085SUSE bug 1205621cpe:/o:suse:suse-microos:5.0CVE-2019-1549SUSE Linux Enterprise Micro 5.0
OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
ModerateCVE-2019-1549SUSE bug 1150247SUSE bug 1154162SUSE bug 1205621cpe:/o:suse:suse-microos:5.0CVE-2019-15504SUSE Linux Enterprise Micro 5.0
drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir).
ImportantCVE-2019-15504SUSE bug 1147116SUSE bug 1185852cpe:/o:suse:suse-microos:5.0CVE-2019-1551SUSE Linux Enterprise Micro 5.0
There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).
ModerateCVE-2019-1551SUSE bug 1158809SUSE bug 1205621cpe:/o:suse:suse-microos:5.0CVE-2019-1563SUSE Linux Enterprise Micro 5.0
In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
ModerateCVE-2019-1563SUSE bug 1150250SUSE bug 1154162SUSE bug 1156430SUSE bug 1205621cpe:/o:suse:suse-microos:5.0CVE-2019-15791SUSE Linux Enterprise Micro 5.0
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the btrfs ioctl completes this fd is closed, which then puts a reference to that file, leading to a refcount underflow.
ImportantCVE-2019-15791SUSE bug 1156640cpe:/o:suse:suse-microos:5.0CVE-2019-15794SUSE Linux Enterprise Micro 5.0
Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vm_file points. On upstream kernels this is not an issue, as no callers dereference vm_file following after call_mmap() returns an error. However, the aufs patchs change mmap_region() to replace the fput() using a local variable with vma_fput(), which will fput() vm_file, leading to a refcount underflow.
ImportantCVE-2019-15794SUSE bug 1158156cpe:/o:suse:suse-microos:5.0CVE-2019-15845SUSE Linux Enterprise Micro 5.0
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
ModerateCVE-2019-15845SUSE bug 1152994cpe:/o:suse:suse-microos:5.0CVE-2019-15890SUSE Linux Enterprise Micro 5.0
libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.
ModerateCVE-2019-15890SUSE bug 1149811SUSE bug 1149813SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2019-15903SUSE Linux Enterprise Micro 5.0
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
ImportantCVE-2019-15903SUSE bug 1149429SUSE bug 1154738SUSE bug 1154806cpe:/o:suse:suse-microos:5.0CVE-2019-15922SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.0.9. There is a NULL pointer dereference for a pf data structure if alloc_disk fails in drivers/block/paride/pf.c.
ModerateCVE-2019-15922SUSE bug 1149607cpe:/o:suse:suse-microos:5.0CVE-2019-15923SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.0.9. There is a NULL pointer dereference for a cd data structure if alloc_disk fails in drivers/block/paride/pf.c.
ModerateCVE-2019-15923SUSE bug 1149609cpe:/o:suse:suse-microos:5.0CVE-2019-15925SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.2.3. An out of bounds access exists in the function hclge_tm_schd_mode_vnet_base_cfg in the file drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c.
ImportantCVE-2019-15925SUSE bug 1149532cpe:/o:suse:suse-microos:5.0CVE-2019-16056SUSE Linux Enterprise Micro 5.0
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.
ModerateCVE-2019-16056SUSE bug 1149955cpe:/o:suse:suse-microos:5.0CVE-2019-16168SUSE Linux Enterprise Micro 5.0
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
ModerateCVE-2019-16168SUSE bug 1150137SUSE bug 1160968cpe:/o:suse:suse-microos:5.0CVE-2019-16201SUSE Linux Enterprise Micro 5.0
WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
ModerateCVE-2019-16201SUSE bug 1152995cpe:/o:suse:suse-microos:5.0CVE-2019-16229SUSE Linux Enterprise Micro 5.0
** DISPUTED ** drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. NOTE: The security community disputes this issues as not being serious enough to be deserving a CVE id.
LowCVE-2019-16229SUSE bug 1150469cpe:/o:suse:suse-microos:5.0CVE-2019-16231SUSE Linux Enterprise Micro 5.0
drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference.
LowCVE-2019-16231SUSE bug 1150466cpe:/o:suse:suse-microos:5.0CVE-2019-16232SUSE Linux Enterprise Micro 5.0
drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference.
LowCVE-2019-16232SUSE bug 1150465cpe:/o:suse:suse-microos:5.0CVE-2019-16233SUSE Linux Enterprise Micro 5.0
drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference.
LowCVE-2019-16233SUSE bug 1150457cpe:/o:suse:suse-microos:5.0CVE-2019-16234SUSE Linux Enterprise Micro 5.0
drivers/net/wireless/intel/iwlwifi/pcie/trans.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference.
LowCVE-2019-16234SUSE bug 1150452cpe:/o:suse:suse-microos:5.0CVE-2019-16254SUSE Linux Enterprise Micro 5.0
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.
ModerateCVE-2019-16254SUSE bug 1152992SUSE bug 1165402cpe:/o:suse:suse-microos:5.0CVE-2019-16255SUSE Linux Enterprise Micro 5.0
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
ImportantCVE-2019-16255SUSE bug 1152990cpe:/o:suse:suse-microos:5.0CVE-2019-16275SUSE Linux Enterprise Micro 5.0
hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The attacker must send a crafted 802.11 frame from a location that is within the 802.11 communications range.
ModerateCVE-2019-16275SUSE bug 1150934cpe:/o:suse:suse-microos:5.0CVE-2019-16714SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are not initialized.
ModerateCVE-2019-16714SUSE bug 1151791cpe:/o:suse:suse-microos:5.0CVE-2019-16884SUSE Linux Enterprise Micro 5.0
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
ModerateCVE-2019-16884SUSE bug 1152308cpe:/o:suse:suse-microos:5.0CVE-2019-16921SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 4.17, hns_roce_alloc_ucontext in drivers/infiniband/hw/hns/hns_roce_main.c does not initialize the resp data structure, which might allow attackers to obtain sensitive information from kernel stack memory, aka CID-df7e40425813.
ImportantCVE-2019-16921SUSE bug 1152516cpe:/o:suse:suse-microos:5.0CVE-2019-16935SUSE Linux Enterprise Micro 5.0
The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.
ModerateCVE-2019-16935SUSE bug 1153238cpe:/o:suse:suse-microos:5.0CVE-2019-17006SUSE Linux Enterprise Micro 5.0
In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.
ModerateCVE-2019-17006SUSE bug 1159819cpe:/o:suse:suse-microos:5.0CVE-2019-17052SUSE Linux Enterprise Micro 5.0
ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-0614e2b73768.
ModerateCVE-2019-17052SUSE bug 1152779cpe:/o:suse:suse-microos:5.0CVE-2019-17053SUSE Linux Enterprise Micro 5.0
ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-e69dbd4619e7.
LowCVE-2019-17053SUSE bug 1152789cpe:/o:suse:suse-microos:5.0CVE-2019-17054SUSE Linux Enterprise Micro 5.0
atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-6cc03e8aa36c.
LowCVE-2019-17054SUSE bug 1152786cpe:/o:suse:suse-microos:5.0CVE-2019-17133SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.
ImportantCVE-2019-17133SUSE bug 1153158SUSE bug 1153161cpe:/o:suse:suse-microos:5.0CVE-2019-17346SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB flushes.
ImportantCVE-2019-17346SUSE bug 1126198cpe:/o:suse:suse-microos:5.0CVE-2019-17347SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incompatible with Linux (and possibly other guest kernels).
ImportantCVE-2019-17347SUSE bug 1126201cpe:/o:suse:suse-microos:5.0CVE-2019-17348SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility between Process Context Identifiers (PCID) and shadow-pagetable switching.
ModerateCVE-2019-17348SUSE bug 1127400cpe:/o:suse:suse-microos:5.0CVE-2019-17349SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl or StoreExcl operation.
ModerateCVE-2019-17349SUSE bug 1138294cpe:/o:suse:suse-microos:5.0CVE-2019-17361SUSE Linux Enterprise Micro 5.0
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
ImportantCVE-2019-17361SUSE bug 1162504cpe:/o:suse:suse-microos:5.0CVE-2019-17498SUSE Linux Enterprise Micro 5.0
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.
ModerateCVE-2019-17498SUSE bug 1154862SUSE bug 1171566cpe:/o:suse:suse-microos:5.0CVE-2019-17543SUSE Linux Enterprise Micro 5.0
LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."
ImportantCVE-2019-17543SUSE bug 1153936SUSE bug 1188549cpe:/o:suse:suse-microos:5.0CVE-2019-17594SUSE Linux Enterprise Micro 5.0
There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
LowCVE-2019-17594SUSE bug 1154036cpe:/o:suse:suse-microos:5.0CVE-2019-17595SUSE Linux Enterprise Micro 5.0
There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
LowCVE-2019-17595SUSE bug 1154037cpe:/o:suse:suse-microos:5.0CVE-2019-17666SUSE Linux Enterprise Micro 5.0
rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow.
ModerateCVE-2019-17666SUSE bug 1154372cpe:/o:suse:suse-microos:5.0CVE-2019-18197SUSE Linux Enterprise Micro 5.0
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.
ImportantCVE-2019-18197SUSE bug 1154609SUSE bug 1157028SUSE bug 1162833SUSE bug 1169511SUSE bug 1190108cpe:/o:suse:suse-microos:5.0CVE-2019-18198SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
ModerateCVE-2019-18198SUSE bug 1154617cpe:/o:suse:suse-microos:5.0CVE-2019-18218SUSE Linux Enterprise Micro 5.0
cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
CriticalCVE-2019-18218SUSE bug 1154661SUSE bug 1190368SUSE bug 1191838cpe:/o:suse:suse-microos:5.0CVE-2019-18224SUSE Linux Enterprise Micro 5.0
idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.
ModerateCVE-2019-18224SUSE bug 1154887cpe:/o:suse:suse-microos:5.0CVE-2019-18348SUSE Linux Enterprise Micro 5.0
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.
ModerateCVE-2019-18348SUSE bug 1155094cpe:/o:suse:suse-microos:5.0CVE-2019-18388SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via malformed commands.
ModerateCVE-2019-18388SUSE bug 1159479cpe:/o:suse:suse-microos:5.0CVE-2019-18389SUSE Linux Enterprise Micro 5.0
A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.
ImportantCVE-2019-18389SUSE bug 1159482cpe:/o:suse:suse-microos:5.0CVE-2019-18390SUSE Linux Enterprise Micro 5.0
An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands.
ModerateCVE-2019-18390SUSE bug 1159478cpe:/o:suse:suse-microos:5.0CVE-2019-18391SUSE Linux Enterprise Micro 5.0
A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.
ImportantCVE-2019-18391SUSE bug 1159486cpe:/o:suse:suse-microos:5.0CVE-2019-18397SUSE Linux Enterprise Micro 5.0
A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.
ImportantCVE-2019-18397SUSE bug 1156260cpe:/o:suse:suse-microos:5.0CVE-2019-18424SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device. This occurs because passed through PCI devices may corrupt host memory after deassignment. When a PCI device is assigned to an untrusted domain, it is possible for that domain to program the device to DMA to an arbitrary address. The IOMMU is used to protect the host from malicious DMA by making sure that the device addresses can only target memory assigned to the guest. However, when the guest domain is torn down, or the device is deassigned, the device is assigned back to dom0, thus allowing any in-flight DMA to potentially target critical host data. An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. Only systems where guests are given direct access to physical devices capable of DMA (PCI pass-through) are vulnerable. Systems which do not use PCI pass-through are not vulnerable.
ImportantCVE-2019-18424SUSE bug 1154461cpe:/o:suse:suse-microos:5.0CVE-2019-18634SUSE Linux Enterprise Micro 5.0
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
CriticalCVE-2019-18634SUSE bug 1162202cpe:/o:suse:suse-microos:5.0CVE-2019-18660SUSE Linux Enterprise Micro 5.0
The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c.
ModerateCVE-2019-18660SUSE bug 1157038SUSE bug 1157923cpe:/o:suse:suse-microos:5.0CVE-2019-18675SUSE Linux Enterprise Micro 5.0
The Linux kernel through 5.3.13 has a start_offset+size Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap implementation. This allows local users (with /dev/video0 access) to obtain read and write permissions on kernel physical pages, which can possibly result in a privilege escalation.
ModerateCVE-2019-18675SUSE bug 1157804cpe:/o:suse:suse-microos:5.0CVE-2019-18680SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 4.4.x before 4.4.195. There is a NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.c that will cause denial of service, aka CID-91573ae4aed0.
ImportantCVE-2019-18680SUSE bug 1155898SUSE bug 1173867cpe:/o:suse:suse-microos:5.0CVE-2019-18683SUSE Linux Enterprise Micro 5.0
An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free.
ModerateCVE-2019-18683SUSE bug 1155897SUSE bug 1173868cpe:/o:suse:suse-microos:5.0CVE-2019-18786SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, which could cause a memory disclosure problem.
LowCVE-2019-18786SUSE bug 1156043cpe:/o:suse:suse-microos:5.0CVE-2019-18802SUSE Linux Enterprise Micro 5.0
An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.
ImportantCVE-2019-18802SUSE bug 1159003cpe:/o:suse:suse-microos:5.0CVE-2019-18807SUSE Linux Enterprise Micro 5.0
Two memory leaks in the sja1105_static_config_upload() function in drivers/net/dsa/sja1105/sja1105_spi.c in the Linux kernel before 5.3.5 allow attackers to cause a denial of service (memory consumption) by triggering static_config_buf_prepare_for_upload() or sja1105_inhibit_tx() failures, aka CID-68501df92d11.
ModerateCVE-2019-18807SUSE bug 1160881cpe:/o:suse:suse-microos:5.0CVE-2019-18808SUSE Linux Enterprise Micro 5.0
A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-128c66429247.
ModerateCVE-2019-18808SUSE bug 1156259SUSE bug 1189884SUSE bug 1190534cpe:/o:suse:suse-microos:5.0CVE-2019-18809SUSE Linux Enterprise Micro 5.0
A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559.
ModerateCVE-2019-18809SUSE bug 1156258cpe:/o:suse:suse-microos:5.0CVE-2019-18810SUSE Linux Enterprise Micro 5.0
A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering drm_writeback_connector_init() failures, aka CID-a0ecd6fdbf5d.
ModerateCVE-2019-18810SUSE bug 1156257cpe:/o:suse:suse-microos:5.0CVE-2019-18811SUSE Linux Enterprise Micro 5.0
A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering sof_get_ctrl_copy_params() failures, aka CID-45c1380358b1.
ModerateCVE-2019-18811SUSE bug 1159374cpe:/o:suse:suse-microos:5.0CVE-2019-18812SUSE Linux Enterprise Micro 5.0
A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-c0a333d842ef.
ModerateCVE-2019-18812SUSE bug 1156277cpe:/o:suse:suse-microos:5.0CVE-2019-18813SUSE Linux Enterprise Micro 5.0
A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering platform_device_add_properties() failures, aka CID-9bbfceea12a8.
ModerateCVE-2019-18813SUSE bug 1156278cpe:/o:suse:suse-microos:5.0CVE-2019-18814SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c.
ModerateCVE-2019-18814SUSE bug 1156256cpe:/o:suse:suse-microos:5.0CVE-2019-18874SUSE Linux Enterprise Micro 5.0
psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
LowCVE-2019-18874SUSE bug 1156525cpe:/o:suse:suse-microos:5.0CVE-2019-18885SUSE Linux Enterprise Micro 5.0
fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a crafted btrfs image because fs_devices->devices is mishandled within find_device, aka CID-09ba3bc9dd15.
ModerateCVE-2019-18885SUSE bug 1156901cpe:/o:suse:suse-microos:5.0CVE-2019-18897SUSE Linux Enterprise Micro 5.0
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions.
ModerateCVE-2019-18897SUSE bug 1157465cpe:/o:suse:suse-microos:5.0CVE-2019-18900SUSE Linux Enterprise Micro 5.0
: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.
LowCVE-2019-18900SUSE bug 1158763cpe:/o:suse:suse-microos:5.0CVE-2019-18902SUSE Linux Enterprise Micro 5.0
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62.
ModerateCVE-2019-18902SUSE bug 1160903cpe:/o:suse:suse-microos:5.0CVE-2019-18903SUSE Linux Enterprise Micro 5.0
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.9.1. openSUSE Factory wicked versions prior to 0.6.62.
ModerateCVE-2019-18903SUSE bug 1160904cpe:/o:suse:suse-microos:5.0CVE-2019-19037SUSE Linux Enterprise Micro 5.0
ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be zero.
ModerateCVE-2019-19037SUSE bug 1157717cpe:/o:suse:suse-microos:5.0CVE-2019-19039SUSE Linux Enterprise Micro 5.0
** DISPUTED ** __btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as not being a vulnerability because “1) The kernel provide facilities to restrict access to dmesg - dmesg_restrict=1 sysctl option. So it's really up to the system administrator to judge whether dmesg access shall be disallowed or not. 2) WARN/WARN_ON are widely used macros in the linux kernel. If this CVE is considered valid this would mean there are literally thousands CVE lurking in the kernel - something which clearly is not the case.”
ModerateCVE-2019-19039SUSE bug 1157719cpe:/o:suse:suse-microos:5.0CVE-2019-19043SUSE Linux Enterprise Micro 5.0
A memory leak in the i40e_setup_macvlans() function in drivers/net/ethernet/intel/i40e/i40e_main.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering i40e_setup_channel() failures, aka CID-27d461333459.
ModerateCVE-2019-19043SUSE bug 1159375cpe:/o:suse:suse-microos:5.0CVE-2019-19044SUSE Linux Enterprise Micro 5.0
Two memory leaks in the v3d_submit_cl_ioctl() function in drivers/gpu/drm/v3d/v3d_gem.c in the Linux kernel before 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering kcalloc() or v3d_job_init() failures, aka CID-29cd13cfd762.
ModerateCVE-2019-19044SUSE bug 1159370cpe:/o:suse:suse-microos:5.0CVE-2019-19045SUSE Linux Enterprise Micro 5.0
A memory leak in the mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_vector2eqn() failures, aka CID-c8c2a057fdc7.
ModerateCVE-2019-19045SUSE bug 1161522cpe:/o:suse:suse-microos:5.0CVE-2019-19046SUSE Linux Enterprise Micro 5.0
** DISPUTED ** A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control this failure at probe time.
ModerateCVE-2019-19046SUSE bug 1157304cpe:/o:suse:suse-microos:5.0CVE-2019-19047SUSE Linux Enterprise Micro 5.0
A memory leak in the mlx5_fw_fatal_reporter_dump() function in drivers/net/ethernet/mellanox/mlx5/core/health.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_crdump_collect() failures, aka CID-c7ed6d0183d5.
LowCVE-2019-19047SUSE bug 1157715cpe:/o:suse:suse-microos:5.0CVE-2019-19048SUSE Linux Enterprise Micro 5.0
A memory leak in the crypto_reportstat() function in drivers/virt/vboxguest/vboxguest_utils.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering copy_form_user() failures, aka CID-e0b0cb938864.
ImportantCVE-2019-19048SUSE bug 1157720cpe:/o:suse:suse-microos:5.0CVE-2019-19049SUSE Linux Enterprise Micro 5.0
** DISPUTED ** A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux kernel before 5.3.10 allows attackers to cause a denial of service (memory consumption) by triggering of_fdt_unflatten_tree() failures, aka CID-e13de8fe0d6a. NOTE: third parties dispute the relevance of this because unittest.c can only be reached during boot.
ModerateCVE-2019-19049SUSE bug 1157173cpe:/o:suse:suse-microos:5.0CVE-2019-19050SUSE Linux Enterprise Micro 5.0
A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_reportstat_alg() failures, aka CID-c03b04dcdba1.
ModerateCVE-2019-19050SUSE bug 1157336cpe:/o:suse:suse-microos:5.0CVE-2019-19051SUSE Linux Enterprise Micro 5.0
A memory leak in the i2400m_op_rfkill_sw_toggle() function in drivers/net/wimax/i2400m/op-rfkill.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-6f3ef5c25cc7.
ModerateCVE-2019-19051SUSE bug 1159024cpe:/o:suse:suse-microos:5.0CVE-2019-19052SUSE Linux Enterprise Micro 5.0
A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-fb5be6a7b486.
ModerateCVE-2019-19052SUSE bug 1157324cpe:/o:suse:suse-microos:5.0CVE-2019-19053SUSE Linux Enterprise Micro 5.0
A memory leak in the rpmsg_eptdev_write_iter() function in drivers/rpmsg/rpmsg_char.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy_from_iter_full() failures, aka CID-bbe692e349e2.
ImportantCVE-2019-19053SUSE bug 1161520cpe:/o:suse:suse-microos:5.0CVE-2019-19054SUSE Linux Enterprise Micro 5.0
A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering kfifo_alloc() failures, aka CID-a7b2df76b42b.
ModerateCVE-2019-19054SUSE bug 1161518cpe:/o:suse:suse-microos:5.0CVE-2019-19055SUSE Linux Enterprise Micro 5.0
** DISPUTED ** A memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering nl80211hdr_put() failures, aka CID-1399c59fa929. NOTE: third parties dispute the relevance of this because it occurs on a code path where a successful allocation has already occurred.
ImportantCVE-2019-19055SUSE bug 1157319cpe:/o:suse:suse-microos:5.0CVE-2019-19056SUSE Linux Enterprise Micro 5.0
A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-db8fd2cde932.
ModerateCVE-2019-19056SUSE bug 1157197cpe:/o:suse:suse-microos:5.0CVE-2019-19057SUSE Linux Enterprise Micro 5.0
Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-d10dcb615c8e.
LowCVE-2019-19057SUSE bug 1157193SUSE bug 1157197cpe:/o:suse:suse-microos:5.0CVE-2019-19058SUSE Linux Enterprise Micro 5.0
A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering alloc_page() failures, aka CID-b4b814fec1a5.
ModerateCVE-2019-19058SUSE bug 1157145cpe:/o:suse:suse-microos:5.0CVE-2019-19059SUSE Linux Enterprise Micro 5.0
Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering iwl_pcie_init_fw_sec() or dma_alloc_coherent() failures, aka CID-0f4f199443fa.
ModerateCVE-2019-19059SUSE bug 1157296cpe:/o:suse:suse-microos:5.0CVE-2019-19060SUSE Linux Enterprise Micro 5.0
A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41.
ModerateCVE-2019-19060SUSE bug 1157178cpe:/o:suse:suse-microos:5.0CVE-2019-19061SUSE Linux Enterprise Micro 5.0
A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-9c0530e898f3.
ModerateCVE-2019-19061SUSE bug 1157192cpe:/o:suse:suse-microos:5.0CVE-2019-19062SUSE Linux Enterprise Micro 5.0
A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042.
ModerateCVE-2019-19062SUSE bug 1157333cpe:/o:suse:suse-microos:5.0CVE-2019-19063SUSE Linux Enterprise Micro 5.0
Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka CID-3f9361695113.
ModerateCVE-2019-19063SUSE bug 1157298cpe:/o:suse:suse-microos:5.0CVE-2019-19064SUSE Linux Enterprise Micro 5.0
** DISPUTED ** A memory leak in the fsl_lpspi_probe() function in drivers/spi/spi-fsl-lpspi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering pm_runtime_get_sync() failures, aka CID-057b8945f78f. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control these failures at probe time.
ModerateCVE-2019-19064SUSE bug 1157300cpe:/o:suse:suse-microos:5.0CVE-2019-19065SUSE Linux Enterprise Micro 5.0
** DISPUTED ** A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering rhashtable_init() failures, aka CID-34b3be18a04e. NOTE: This has been disputed as not a vulnerability because "rhashtable_init() can only fail if it is passed invalid values in the second parameter's struct, but when invoked from sdma_init() that is a pointer to a static const struct, so an attacker could only trigger failure if they could corrupt kernel memory (in which case a small memory leak is not a significant problem)."
ImportantCVE-2019-19065SUSE bug 1157191SUSE bug 1173961cpe:/o:suse:suse-microos:5.0CVE-2019-19066SUSE Linux Enterprise Micro 5.0
A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures, aka CID-0e62395da2bd.
ModerateCVE-2019-19066SUSE bug 1157303cpe:/o:suse:suse-microos:5.0CVE-2019-19067SUSE Linux Enterprise Micro 5.0
** DISPUTED ** Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption) by triggering mfd_add_hotplug_devices() or pm_genpd_add_device() failures, aka CID-57be09c6e874. NOTE: third parties dispute the relevance of this because the attacker must already have privileges for module loading.
ModerateCVE-2019-19067SUSE bug 1157180cpe:/o:suse:suse-microos:5.0CVE-2019-19068SUSE Linux Enterprise Micro 5.0
A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-a2cdd07488e6.
ModerateCVE-2019-19068SUSE bug 1157307cpe:/o:suse:suse-microos:5.0CVE-2019-19069SUSE Linux Enterprise Micro 5.0
A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering dma_get_sgtable() failures, aka CID-fc739a058d99.
ModerateCVE-2019-19069SUSE bug 1157064cpe:/o:suse:suse-microos:5.0CVE-2019-19070SUSE Linux Enterprise Micro 5.0
** DISPUTED ** A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering devm_add_action_or_reset() failures, aka CID-d3b0ffa1d75d. NOTE: third parties dispute the relevance of this because the system must have already been out of memory before the probe began.
ImportantCVE-2019-19070SUSE bug 1157294cpe:/o:suse:suse-microos:5.0CVE-2019-19071SUSE Linux Enterprise Micro 5.0
A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering rsi_prepare_beacon() failures, aka CID-d563131ef23c.
ModerateCVE-2019-19071SUSE bug 1157067cpe:/o:suse:suse-microos:5.0CVE-2019-19072SUSE Linux Enterprise Micro 5.0
A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6.
ModerateCVE-2019-19072SUSE bug 1157069cpe:/o:suse:suse-microos:5.0CVE-2019-19073SUSE Linux Enterprise Micro 5.0
Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, and the htc_connect_service() function, aka CID-853acf7caf10.
ModerateCVE-2019-19073SUSE bug 1157070cpe:/o:suse:suse-microos:5.0CVE-2019-19074SUSE Linux Enterprise Micro 5.0
A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.
ModerateCVE-2019-19074SUSE bug 1157143cpe:/o:suse:suse-microos:5.0CVE-2019-19075SUSE Linux Enterprise Micro 5.0
A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures, aka CID-6402939ec86e.
LowCVE-2019-19075SUSE bug 1157162SUSE bug 1173958cpe:/o:suse:suse-microos:5.0CVE-2019-19076SUSE Linux Enterprise Micro 5.0
** DISPUTED ** A memory leak in the nfp_abm_u32_knode_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 allows attackers to cause a denial of service (memory consumption), aka CID-78beef629fd9. NOTE: This has been argued as not a valid vulnerability. The upstream commit 78beef629fd9 was reverted.
ModerateCVE-2019-19076SUSE bug 1157164cpe:/o:suse:suse-microos:5.0CVE-2019-19077SUSE Linux Enterprise Micro 5.0
A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy to udata failures, aka CID-4a9d46a9fe14.
ModerateCVE-2019-19077SUSE bug 1157171cpe:/o:suse:suse-microos:5.0CVE-2019-19078SUSE Linux Enterprise Micro 5.0
A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2.
ModerateCVE-2019-19078SUSE bug 1157032cpe:/o:suse:suse-microos:5.0CVE-2019-19079SUSE Linux Enterprise Micro 5.0
A memory leak in the qrtr_tun_write_iter() function in net/qrtr/tun.c in the Linux kernel before 5.3 allows attackers to cause a denial of service (memory consumption), aka CID-a21b7f0cff19.
ImportantCVE-2019-19079SUSE bug 1157039cpe:/o:suse:suse-microos:5.0CVE-2019-19080SUSE Linux Enterprise Micro 5.0
Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.
ModerateCVE-2019-19080SUSE bug 1157044cpe:/o:suse:suse-microos:5.0CVE-2019-19081SUSE Linux Enterprise Micro 5.0
A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.
ModerateCVE-2019-19081SUSE bug 1157045cpe:/o:suse:suse-microos:5.0CVE-2019-19082SUSE Linux Enterprise Micro 5.0
Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption). This affects the dce120_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, the dce100_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, and the dce112_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, aka CID-104c307147ad.
ModerateCVE-2019-19082SUSE bug 1157046cpe:/o:suse:suse-microos:5.0CVE-2019-19083SUSE Linux Enterprise Micro 5.0
Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption). This affects the dce112_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, the dce100_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, the dcn20_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c, the dce120_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, and the dce80_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c, aka CID-055e547478a1.
ModerateCVE-2019-19083SUSE bug 1157049cpe:/o:suse:suse-microos:5.0CVE-2019-19126SUSE Linux Enterprise Micro 5.0
On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.
LowCVE-2019-19126SUSE bug 1157292cpe:/o:suse:suse-microos:5.0CVE-2019-19234SUSE Linux Enterprise Micro 5.0
** DISPUTED ** In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user. NOTE: The software maintainer believes that this CVE is not valid. Disabling local password authentication for a user is not the same as disabling all access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shadow(5) and passwd(1) manuals are clear on this. Indeed it is a valid use case to have local accounts that are _only_ accessible via sudo and that cannot be logged into with a password. Sudo 1.8.30 added an optional setting to check the _shell_ of the target user (not the encrypted password!) against the contents of /etc/shells but that is not the same thing as preventing access to users with an invalid password hash.
ImportantCVE-2019-19234SUSE bug 1159616cpe:/o:suse:suse-microos:5.0CVE-2019-19241SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/io_uring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback interface. This occurs because IORING_OP_SENDMSG operations, although requested in the context of an unprivileged user, are sometimes performed by a kernel worker thread without considering that context.
ImportantCVE-2019-19241SUSE bug 1159441cpe:/o:suse:suse-microos:5.0CVE-2019-19244SUSE Linux Enterprise Micro 5.0
sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.
ModerateCVE-2019-19244SUSE bug 1157817SUSE bug 1157818cpe:/o:suse:suse-microos:5.0CVE-2019-19252SUSE Linux Enterprise Micro 5.0
vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a.
ModerateCVE-2019-19252SUSE bug 1157813cpe:/o:suse:suse-microos:5.0CVE-2019-19317SUSE Linux Enterprise Micro 5.0
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
LowCVE-2019-19317SUSE bug 1158812SUSE bug 1196773SUSE bug 1196775cpe:/o:suse:suse-microos:5.0CVE-2019-19332SUSE Linux Enterprise Micro 5.0
An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of service.
ModerateCVE-2019-19332SUSE bug 1158827cpe:/o:suse:suse-microos:5.0CVE-2019-19338SUSE Linux Enterprise Micro 5.0
A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
ModerateCVE-2019-19338SUSE bug 1158954cpe:/o:suse:suse-microos:5.0CVE-2019-19378SUSE Linux Enterprise Micro 5.0
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image can lead to slab-out-of-bounds write access in index_rbio_pages in fs/btrfs/raid56.c.
ImportantCVE-2019-19378SUSE bug 1158270SUSE bug 1185853cpe:/o:suse:suse-microos:5.0CVE-2019-19447SUSE Linux Enterprise Micro 5.0
In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c.
ImportantCVE-2019-19447SUSE bug 1158819SUSE bug 1173869cpe:/o:suse:suse-microos:5.0CVE-2019-19448SUSE Linux Enterprise Micro 5.0
In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure.
ImportantCVE-2019-19448SUSE bug 1158820SUSE bug 1162369SUSE bug 1173871cpe:/o:suse:suse-microos:5.0CVE-2019-19449SUSE Linux Enterprise Micro 5.0
In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c, related to init_min_max_mtime in fs/f2fs/segment.c (because the second argument to get_seg_entry is not validated).
ImportantCVE-2019-19449SUSE bug 1158821cpe:/o:suse:suse-microos:5.0CVE-2019-19462SUSE Linux Enterprise Micro 5.0
relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result.
LowCVE-2019-19462SUSE bug 1158265cpe:/o:suse:suse-microos:5.0CVE-2019-19523SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79.
ModerateCVE-2019-19523SUSE bug 1158381SUSE bug 1158823SUSE bug 1158834cpe:/o:suse:suse-microos:5.0CVE-2019-19524SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9.
LowCVE-2019-19524SUSE bug 1158381SUSE bug 1158413SUSE bug 1158834cpe:/o:suse:suse-microos:5.0CVE-2019-19525SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.3.6, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver, aka CID-7fd25e6fc035.
ModerateCVE-2019-19525SUSE bug 1158381SUSE bug 1158417SUSE bug 1158834cpe:/o:suse:suse-microos:5.0CVE-2019-19526SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka CID-6af3aa57a098.
ModerateCVE-2019-19526SUSE bug 1158381SUSE bug 1158834SUSE bug 1158893cpe:/o:suse:suse-microos:5.0CVE-2019-19528SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver, aka CID-edc4746f253d.
ModerateCVE-2019-19528SUSE bug 1158381SUSE bug 1158407SUSE bug 1158834cpe:/o:suse:suse-microos:5.0CVE-2019-19529SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.3.11, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c driver, aka CID-4d6636498c41.
ModerateCVE-2019-19529SUSE bug 1158381SUSE bug 1158834cpe:/o:suse:suse-microos:5.0CVE-2019-19532SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c, drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c, drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-tmff.c, and drivers/hid/hid-zpff.c.
ModerateCVE-2019-19532SUSE bug 1158381SUSE bug 1158823SUSE bug 1158824SUSE bug 1158834cpe:/o:suse:suse-microos:5.0CVE-2019-19533SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.3.4, there is an info-leak bug that can be caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c driver, aka CID-a10feaf8c464.
LowCVE-2019-19533SUSE bug 1158381SUSE bug 1158834cpe:/o:suse:suse-microos:5.0CVE-2019-19534SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29.
LowCVE-2019-19534SUSE bug 1158381SUSE bug 1158398SUSE bug 1158834cpe:/o:suse:suse-microos:5.0CVE-2019-19579SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device (and assignable-add is not used), because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. Unfortunately, this is not considered a strictly required step for device assignment. The PCI passthrough documentation on the wiki describes alternate ways of preparing devices for assignment, and libvirt uses its own ways as well. Hosts where these "alternate" methods are used will still leave the system in a vulnerable state after the device comes back from a guest. An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. Only systems where guests are given direct access to physical devices capable of DMA (PCI pass-through) are vulnerable. Systems which do not use PCI pass-through are not vulnerable.
ModerateCVE-2019-19579SUSE bug 1157888cpe:/o:suse:suse-microos:5.0CVE-2019-19581SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bounds access) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On 32-bit Arm accesses to bitmaps with bit a count which is a multiple of 32, an out of bounds access may occur. A malicious guest may cause a hypervisor crash or hang, resulting in a Denial of Service (DoS). All versions of Xen are vulnerable. 32-bit Arm systems are vulnerable. 64-bit Arm systems are not vulnerable.
ModerateCVE-2019-19581SUSE bug 1158003cpe:/o:suse:suse-microos:5.0CVE-2019-19582SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On x86 accesses to bitmaps with a compile time known size of 64 may incur undefined behavior, which may in particular result in infinite loops. A malicious guest may cause a hypervisor crash or hang, resulting in a Denial of Service (DoS). All versions of Xen are vulnerable. x86 systems with 64 or more nodes are vulnerable (there might not be any such systems that Xen would run on). x86 systems with less than 64 nodes are not vulnerable.
ModerateCVE-2019-19582SUSE bug 1158003cpe:/o:suse:suse-microos:5.0CVE-2019-19602SUSE Linux Enterprise Micro 5.0
fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstrated by mishandling of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64, aka CID-59c4bd853abc.
LowCVE-2019-19602SUSE bug 1158887cpe:/o:suse:suse-microos:5.0CVE-2019-19603SUSE Linux Enterprise Micro 5.0
SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
ImportantCVE-2019-19603SUSE bug 1158960SUSE bug 1193078cpe:/o:suse:suse-microos:5.0CVE-2019-19645SUSE Linux Enterprise Micro 5.0
alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
ModerateCVE-2019-19645SUSE bug 1158958cpe:/o:suse:suse-microos:5.0CVE-2019-19646SUSE Linux Enterprise Micro 5.0
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
ModerateCVE-2019-19646SUSE bug 1158959cpe:/o:suse:suse-microos:5.0CVE-2019-19767SUSE Linux Enterprise Micro 5.0
The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163.
ModerateCVE-2019-19767SUSE bug 1159297cpe:/o:suse:suse-microos:5.0CVE-2019-19768SUSE Linux Enterprise Micro 5.0
In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer).
ModerateCVE-2019-19768SUSE bug 1159285cpe:/o:suse:suse-microos:5.0CVE-2019-19769SUSE Linux Enterprise Micro 5.0
In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h).
ModerateCVE-2019-19769SUSE bug 1159280cpe:/o:suse:suse-microos:5.0CVE-2019-19770SUSE Linux Enterprise Micro 5.0
** DISPUTED ** In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel developers dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of debugfs within blktrace.
ModerateCVE-2019-19770SUSE bug 1159198SUSE bug 1171295cpe:/o:suse:suse-microos:5.0CVE-2019-19807SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring.
ImportantCVE-2019-19807SUSE bug 1159281cpe:/o:suse:suse-microos:5.0CVE-2019-19814SUSE Linux Enterprise Micro 5.0
In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access because an array is bounded by the number of dirty types (8) but the array index can exceed this.
CriticalCVE-2019-19814SUSE bug 1159437cpe:/o:suse:suse-microos:5.0CVE-2019-19815SUSE Linux Enterprise Micro 5.0
In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs_recover_fsync_data in fs/f2fs/recovery.c. This is related to F2FS_P_SB in fs/f2fs/f2fs.h.
ModerateCVE-2019-19815SUSE bug 1159438cpe:/o:suse:suse-microos:5.0CVE-2019-19880SUSE Linux Enterprise Micro 5.0
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
ImportantCVE-2019-19880SUSE bug 1159491SUSE bug 1159715SUSE bug 1162833cpe:/o:suse:suse-microos:5.0CVE-2019-19921SUSE Linux Enterprise Micro 5.0
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)
ModerateCVE-2019-19921SUSE bug 1160452SUSE bug 1208962cpe:/o:suse:suse-microos:5.0CVE-2019-19922SUSE Linux Enterprise Micro 5.0
kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)
ModerateCVE-2019-19922SUSE bug 1159717cpe:/o:suse:suse-microos:5.0CVE-2019-19923SUSE Linux Enterprise Micro 5.0
flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).
ModerateCVE-2019-19923SUSE bug 1160309SUSE bug 1162833cpe:/o:suse:suse-microos:5.0CVE-2019-19924SUSE Linux Enterprise Micro 5.0
SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.
ModerateCVE-2019-19924SUSE bug 1159850cpe:/o:suse:suse-microos:5.0CVE-2019-19925SUSE Linux Enterprise Micro 5.0
zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
LowCVE-2019-19925SUSE bug 1159847SUSE bug 1162833cpe:/o:suse:suse-microos:5.0CVE-2019-19926SUSE Linux Enterprise Micro 5.0
multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.
ImportantCVE-2019-19926SUSE bug 1159491SUSE bug 1159715SUSE bug 1162833cpe:/o:suse:suse-microos:5.0CVE-2019-19947SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c.
LowCVE-2019-19947SUSE bug 1159929cpe:/o:suse:suse-microos:5.0CVE-2019-19956SUSE Linux Enterprise Micro 5.0
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
ModerateCVE-2019-19956SUSE bug 1159928SUSE bug 1191860cpe:/o:suse:suse-microos:5.0CVE-2019-19959SUSE Linux Enterprise Micro 5.0
ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.
ModerateCVE-2019-19959SUSE bug 1160438cpe:/o:suse:suse-microos:5.0CVE-2019-19965SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5.
ModerateCVE-2019-19965SUSE bug 1159911cpe:/o:suse:suse-microos:5.0CVE-2019-19977SUSE Linux Enterprise Micro 5.0
libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.
ImportantCVE-2019-19977SUSE bug 1160462SUSE bug 1189097SUSE bug 1190329SUSE bug 1191840SUSE bug 1192365SUSE bug 1193380SUSE bug 1193381cpe:/o:suse:suse-microos:5.0CVE-2019-20218SUSE Linux Enterprise Micro 5.0
selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
ImportantCVE-2019-20218SUSE bug 1160439SUSE bug 1189840SUSE bug 1190372SUSE bug 1192495SUSE bug 1193078cpe:/o:suse:suse-microos:5.0CVE-2019-20367SUSE Linux Enterprise Micro 5.0
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).
ModerateCVE-2019-20367SUSE bug 1160551cpe:/o:suse:suse-microos:5.0CVE-2019-20386SUSE Linux Enterprise Micro 5.0
An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.
LowCVE-2019-20386SUSE bug 1161436cpe:/o:suse:suse-microos:5.0CVE-2019-20388SUSE Linux Enterprise Micro 5.0
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
LowCVE-2019-20388SUSE bug 1161521SUSE bug 1191860cpe:/o:suse:suse-microos:5.0CVE-2019-20422SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.3.4, fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count decision, leading to (for example) a crash that was identified by syzkaller, aka CID-7b09c2d052db.
ModerateCVE-2019-20422SUSE bug 1161897cpe:/o:suse:suse-microos:5.0CVE-2019-2054SUSE Linux Enterprise Micro 5.0
In the seccomp implementation prior to kernel version 4.8, there is a possible seccomp bypass due to seccomp policies that allow the use of ptrace. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-119769499
ImportantCVE-2019-2054SUSE bug 1134561SUSE bug 1181039cpe:/o:suse:suse-microos:5.0CVE-2019-20794SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 4.18 through 5.6.11 when unprivileged user namespaces are allowed. A user can create their own PID namespace, and mount a FUSE filesystem. Upon interaction with this FUSE filesystem, if the userspace component is terminated via a kill of the PID namespace's pid 1, it will result in a hung task, and resources being permanently locked up until system reboot. This can result in resource exhaustion.
ModerateCVE-2019-20794SUSE bug 1171737cpe:/o:suse:suse-microos:5.0CVE-2019-20795SUSE Linux Enterprise Micro 5.0
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
ModerateCVE-2019-20795SUSE bug 1171452cpe:/o:suse:suse-microos:5.0CVE-2019-20807SUSE Linux Enterprise Micro 5.0
In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).
ModerateCVE-2019-20807SUSE bug 1172225cpe:/o:suse:suse-microos:5.0CVE-2019-20810SUSE Linux Enterprise Micro 5.0
go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586.
LowCVE-2019-20810SUSE bug 1172458cpe:/o:suse:suse-microos:5.0CVE-2019-20812SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067.
ModerateCVE-2019-20812SUSE bug 1172453cpe:/o:suse:suse-microos:5.0CVE-2019-20838SUSE Linux Enterprise Micro 5.0
libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.
ImportantCVE-2019-20838SUSE bug 1172973SUSE bug 1189526SUSE bug 1193384cpe:/o:suse:suse-microos:5.0CVE-2019-20907SUSE Linux Enterprise Micro 5.0
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
ModerateCVE-2019-20907SUSE bug 1174091cpe:/o:suse:suse-microos:5.0CVE-2019-20916SUSE Linux Enterprise Micro 5.0
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
ModerateCVE-2019-20916SUSE bug 1176262cpe:/o:suse:suse-microos:5.0CVE-2019-2182SUSE Linux Enterprise Micro 5.0
In the Android kernel in the kernel MMU code there is a possible execution path leaving some kernel text and rodata pages writable. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
ImportantCVE-2019-2182SUSE bug 1150022cpe:/o:suse:suse-microos:5.0CVE-2019-2201SUSE Linux Enterprise Micro 5.0
In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120551338
ImportantCVE-2019-2201SUSE bug 1156402cpe:/o:suse:suse-microos:5.0CVE-2019-2213SUSE Linux Enterprise Micro 5.0
In binder_free_transaction of binder.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-133758011References: Upstream kernel
ModerateCVE-2019-2213SUSE bug 1156185cpe:/o:suse:suse-microos:5.0CVE-2019-2214SUSE Linux Enterprise Micro 5.0
In binder_transaction of binder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-136210786References: Upstream kernel
ImportantCVE-2019-2214SUSE bug 1156186cpe:/o:suse:suse-microos:5.0CVE-2019-2215SUSE Linux Enterprise Micro 5.0
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
ModerateCVE-2019-2215SUSE bug 1164867cpe:/o:suse:suse-microos:5.0CVE-2019-25044SUSE Linux Enterprise Micro 5.0
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.
ImportantCVE-2019-25044SUSE bug 1186175cpe:/o:suse:suse-microos:5.0CVE-2019-25045SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46.
ImportantCVE-2019-25045SUSE bug 1187049cpe:/o:suse:suse-microos:5.0CVE-2019-3016SUSE Linux Enterprise Micro 5.0
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
ModerateCVE-2019-3016SUSE bug 1159281SUSE bug 1161154cpe:/o:suse:suse-microos:5.0CVE-2019-3687SUSE Linux Enterprise Micro 5.0
The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa.
ModerateCVE-2019-3687SUSE bug 1148788SUSE bug 1180102cpe:/o:suse:suse-microos:5.0CVE-2019-3688SUSE Linux Enterprise Micro 5.0
The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary
ModerateCVE-2019-3688SUSE bug 1093414SUSE bug 1149108cpe:/o:suse:suse-microos:5.0CVE-2019-3689SUSE Linux Enterprise Micro 5.0
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.
ImportantCVE-2019-3689SUSE bug 1150733cpe:/o:suse:suse-microos:5.0CVE-2019-3690SUSE Linux Enterprise Micro 5.0
The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.
ModerateCVE-2019-3690SUSE bug 1148336SUSE bug 1150734SUSE bug 1157880SUSE bug 1157883SUSE bug 1160594SUSE bug 1160764SUSE bug 1163922cpe:/o:suse:suse-microos:5.0CVE-2019-3813SUSE Linux Enterprise Micro 5.0
Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.
ImportantCVE-2019-3813SUSE bug 1122706cpe:/o:suse:suse-microos:5.0CVE-2019-3822SUSE Linux Enterprise Micro 5.0
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.
ImportantCVE-2019-3822SUSE bug 1123377SUSE bug 1141798cpe:/o:suse:suse-microos:5.0CVE-2019-3823SUSE Linux Enterprise Micro 5.0
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.
ModerateCVE-2019-3823SUSE bug 1123378SUSE bug 1126909SUSE bug 1141798cpe:/o:suse:suse-microos:5.0CVE-2019-3829SUSE Linux Enterprise Micro 5.0
A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.
ModerateCVE-2019-3829SUSE bug 1130681cpe:/o:suse:suse-microos:5.0CVE-2019-3836SUSE Linux Enterprise Micro 5.0
It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.
ModerateCVE-2019-3836SUSE bug 1130682cpe:/o:suse:suse-microos:5.0CVE-2019-3837SUSE Linux Enterprise Micro 5.0
It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.
ModerateCVE-2019-3837SUSE bug 1131430cpe:/o:suse:suse-microos:5.0CVE-2019-3842SUSE Linux Enterprise Micro 5.0
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".
ModerateCVE-2019-3842SUSE bug 1132348cpe:/o:suse:suse-microos:5.0CVE-2019-3843SUSE Linux Enterprise Micro 5.0
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.
ModerateCVE-2019-3843SUSE bug 1133506cpe:/o:suse:suse-microos:5.0CVE-2019-3844SUSE Linux Enterprise Micro 5.0
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.
ModerateCVE-2019-3844SUSE bug 1133509cpe:/o:suse:suse-microos:5.0CVE-2019-3855SUSE Linux Enterprise Micro 5.0
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
LowCVE-2019-3855SUSE bug 1128471SUSE bug 1134329SUSE bug 1135434SUSE bug 1141850cpe:/o:suse:suse-microos:5.0CVE-2019-3856SUSE Linux Enterprise Micro 5.0
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
LowCVE-2019-3856SUSE bug 1128472SUSE bug 1135434cpe:/o:suse:suse-microos:5.0CVE-2019-3857SUSE Linux Enterprise Micro 5.0
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
LowCVE-2019-3857SUSE bug 1128474SUSE bug 1135434cpe:/o:suse:suse-microos:5.0CVE-2019-3858SUSE Linux Enterprise Micro 5.0
An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
ModerateCVE-2019-3858SUSE bug 1128476SUSE bug 1135434cpe:/o:suse:suse-microos:5.0CVE-2019-3859SUSE Linux Enterprise Micro 5.0
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
LowCVE-2019-3859SUSE bug 1128480SUSE bug 1130103SUSE bug 1135434cpe:/o:suse:suse-microos:5.0CVE-2019-3860SUSE Linux Enterprise Micro 5.0
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
LowCVE-2019-3860SUSE bug 1128481SUSE bug 1135434SUSE bug 1136570cpe:/o:suse:suse-microos:5.0CVE-2019-3861SUSE Linux Enterprise Micro 5.0
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
LowCVE-2019-3861SUSE bug 1128490SUSE bug 1135434cpe:/o:suse:suse-microos:5.0CVE-2019-3862SUSE Linux Enterprise Micro 5.0
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
LowCVE-2019-3862SUSE bug 1128492SUSE bug 1135434cpe:/o:suse:suse-microos:5.0CVE-2019-3863SUSE Linux Enterprise Micro 5.0
A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used as an index to copy memory causing in an out of bounds memory write error.
LowCVE-2019-3863SUSE bug 1128493SUSE bug 1130103SUSE bug 1135434cpe:/o:suse:suse-microos:5.0CVE-2019-3886SUSE Linux Enterprise Micro 5.0
An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.
LowCVE-2019-3886SUSE bug 1131595SUSE bug 1133150SUSE bug 1138301cpe:/o:suse:suse-microos:5.0CVE-2019-3896SUSE Linux Enterprise Micro 5.0
A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS).
ModerateCVE-2019-3896SUSE bug 1138943SUSE bug 1156434SUSE bug 1173987cpe:/o:suse:suse-microos:5.0CVE-2019-3901SUSE Linux Enterprise Micro 5.0
A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8.
LowCVE-2019-3901SUSE bug 1132374SUSE bug 1133106cpe:/o:suse:suse-microos:5.0CVE-2019-5008SUSE Linux Enterprise Micro 5.0
hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a denial of service via a device driver.
ModerateCVE-2019-5008SUSE bug 1133031cpe:/o:suse:suse-microos:5.0CVE-2019-5010SUSE Linux Enterprise Micro 5.0
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.
ImportantCVE-2019-5010SUSE bug 1122191SUSE bug 1126909cpe:/o:suse:suse-microos:5.0CVE-2019-5068SUSE Linux Enterprise Micro 5.0
An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared memory without any specific permissions to trigger this vulnerability.
ModerateCVE-2019-5068SUSE bug 1156015cpe:/o:suse:suse-microos:5.0CVE-2019-5094SUSE Linux Enterprise Micro 5.0
An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
ModerateCVE-2019-5094SUSE bug 1152101cpe:/o:suse:suse-microos:5.0CVE-2019-5188SUSE Linux Enterprise Micro 5.0
A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
ModerateCVE-2019-5188SUSE bug 1160571cpe:/o:suse:suse-microos:5.0CVE-2019-5435SUSE Linux Enterprise Micro 5.0
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
ModerateCVE-2019-5435SUSE bug 1135176SUSE bug 1154162cpe:/o:suse:suse-microos:5.0CVE-2019-5436SUSE Linux Enterprise Micro 5.0
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
ImportantCVE-2019-5436SUSE bug 1135170SUSE bug 1149496SUSE bug 1154162SUSE bug 1167096cpe:/o:suse:suse-microos:5.0CVE-2019-5481SUSE Linux Enterprise Micro 5.0
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
ModerateCVE-2019-5481SUSE bug 1149495cpe:/o:suse:suse-microos:5.0CVE-2019-5482SUSE Linux Enterprise Micro 5.0
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
ImportantCVE-2019-5482SUSE bug 1149496SUSE bug 1156634cpe:/o:suse:suse-microos:5.0CVE-2019-5544SUSE Linux Enterprise Micro 5.0
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
CriticalCVE-2019-5544SUSE bug 1157869cpe:/o:suse:suse-microos:5.0CVE-2019-5736SUSE Linux Enterprise Micro 5.0
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
ImportantCVE-2019-5736SUSE bug 1121967SUSE bug 1122185SUSE bug 1173421cpe:/o:suse:suse-microos:5.0CVE-2019-6109SUSE Linux Enterprise Micro 5.0
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
ModerateCVE-2019-6109SUSE bug 1121571SUSE bug 1121816SUSE bug 1121818SUSE bug 1121821SUSE bug 1138392SUSE bug 1144902SUSE bug 1144903SUSE bug 1148884cpe:/o:suse:suse-microos:5.0CVE-2019-6110SUSE Linux Enterprise Micro 5.0
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
ModerateCVE-2019-6110SUSE bug 1121571SUSE bug 1121816SUSE bug 1121818SUSE bug 1121821cpe:/o:suse:suse-microos:5.0CVE-2019-6111SUSE Linux Enterprise Micro 5.0
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
ModerateCVE-2019-6111SUSE bug 1121571SUSE bug 1121816SUSE bug 1121818SUSE bug 1121821SUSE bug 1123028SUSE bug 1123220SUSE bug 1131109SUSE bug 1138392SUSE bug 1144902SUSE bug 1144903SUSE bug 1148884SUSE bug 1201840cpe:/o:suse:suse-microos:5.0CVE-2019-6133SUSE Linux Enterprise Micro 5.0
In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.
ModerateCVE-2019-6133SUSE bug 1070943SUSE bug 1121826SUSE bug 1121872cpe:/o:suse:suse-microos:5.0CVE-2019-6250SUSE Linux Enterprise Micro 5.0
A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_decoder.cpp zmq::v2_decoder_t::size_ready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leveraged to run arbitrary code on the target system. The memory layout allows the attacker to inject OS commands into a data structure located immediately after the problematic buffer (i.e., it is not necessary to use a typical buffer-overflow exploitation technique that changes the flow of control).
ImportantCVE-2019-6250SUSE bug 1121717SUSE bug 1122012cpe:/o:suse:suse-microos:5.0CVE-2019-6285SUSE Linux Enterprise Micro 5.0
The SingleDocParser::HandleFlowSequence function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
ModerateCVE-2019-6285SUSE bug 1122004SUSE bug 1122021SUSE bug 1129245cpe:/o:suse:suse-microos:5.0CVE-2019-6292SUSE Linux Enterprise Micro 5.0
An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser, and there is a stack consumption problem caused by recursive stack frames: HandleCompactMap, HandleMap, HandleFlowSequence, HandleSequence, HandleNode. Remote attackers could leverage this vulnerability to cause a denial-of-service via a cpp file.
ModerateCVE-2019-6292SUSE bug 1122021cpe:/o:suse:suse-microos:5.0CVE-2019-6454SUSE Linux Enterprise Micro 5.0
An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).
ImportantCVE-2019-6454SUSE bug 1125352cpe:/o:suse:suse-microos:5.0CVE-2019-6462SUSE Linux Enterprise Micro 5.0
An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.
LowCVE-2019-6462SUSE bug 1122321cpe:/o:suse:suse-microos:5.0CVE-2019-6706SUSE Linux Enterprise Micro 5.0
Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.
ModerateCVE-2019-6706SUSE bug 1123043cpe:/o:suse:suse-microos:5.0CVE-2019-6778SUSE Linux Enterprise Micro 5.0
In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.
ImportantCVE-2019-6778SUSE bug 1123156SUSE bug 1123157SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2019-7146SUSE Linux Enterprise Micro 5.0
In elfutils 0.175, there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted elf file, as demonstrated by eu-readelf.
LowCVE-2019-7146SUSE bug 1123545cpe:/o:suse:suse-microos:5.0CVE-2019-7150SUSE Linux Enterprise Micro 5.0
An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.
LowCVE-2019-7150SUSE bug 1123685cpe:/o:suse:suse-microos:5.0CVE-2019-7317SUSE Linux Enterprise Micro 5.0
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
LowCVE-2019-7317SUSE bug 1124211SUSE bug 1135824SUSE bug 1141780SUSE bug 1147021SUSE bug 1165297cpe:/o:suse:suse-microos:5.0CVE-2019-7665SUSE Linux Enterprise Micro 5.0
In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.
LowCVE-2019-7665SUSE bug 1125007cpe:/o:suse:suse-microos:5.0CVE-2019-8320SUSE Linux Enterprise Micro 5.0
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
ImportantCVE-2019-8320SUSE bug 1130627cpe:/o:suse:suse-microos:5.0CVE-2019-8321SUSE Linux Enterprise Micro 5.0
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
ImportantCVE-2019-8321SUSE bug 1130623cpe:/o:suse:suse-microos:5.0CVE-2019-8322SUSE Linux Enterprise Micro 5.0
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
ImportantCVE-2019-8322SUSE bug 1130622cpe:/o:suse:suse-microos:5.0CVE-2019-8323SUSE Linux Enterprise Micro 5.0
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
ImportantCVE-2019-8323SUSE bug 1130620cpe:/o:suse:suse-microos:5.0CVE-2019-8324SUSE Linux Enterprise Micro 5.0
An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
ImportantCVE-2019-8324SUSE bug 1130617cpe:/o:suse:suse-microos:5.0CVE-2019-8325SUSE Linux Enterprise Micro 5.0
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)
ImportantCVE-2019-8325SUSE bug 1130611cpe:/o:suse:suse-microos:5.0CVE-2019-8341SUSE Linux Enterprise Micro 5.0
** DISPUTED ** An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing.
ImportantCVE-2019-8341SUSE bug 1125815cpe:/o:suse:suse-microos:5.0CVE-2019-8905SUSE Linux Enterprise Micro 5.0
do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360.
ModerateCVE-2019-8905SUSE bug 1126117SUSE bug 1126118cpe:/o:suse:suse-microos:5.0CVE-2019-8906SUSE Linux Enterprise Micro 5.0
do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.
ModerateCVE-2019-8906SUSE bug 1126119cpe:/o:suse:suse-microos:5.0CVE-2019-8907SUSE Linux Enterprise Micro 5.0
do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact.
ModerateCVE-2019-8907SUSE bug 1126117cpe:/o:suse:suse-microos:5.0CVE-2019-8912SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr.
ImportantCVE-2019-8912SUSE bug 1125907SUSE bug 1126284cpe:/o:suse:suse-microos:5.0CVE-2019-8934SUSE Linux Enterprise Micro 5.0
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
LowCVE-2019-8934SUSE bug 1118900SUSE bug 1126455cpe:/o:suse:suse-microos:5.0CVE-2019-8956SUSE Linux Enterprise Micro 5.0
In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp_sendmsg()" function (net/sctp/socket.c) when handling SCTP_SENDALL flag can be exploited to corrupt memory.
ImportantCVE-2019-8956SUSE bug 1124136cpe:/o:suse:suse-microos:5.0CVE-2019-9162SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write operations possible, leading to an OOPS or local privilege escalation. This affects snmp_version and snmp_helper.
ImportantCVE-2019-9162SUSE bug 1127324cpe:/o:suse:suse-microos:5.0CVE-2019-9169SUSE Linux Enterprise Micro 5.0
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
ModerateCVE-2019-9169SUSE bug 1127308SUSE bug 1146392cpe:/o:suse:suse-microos:5.0CVE-2019-9445SUSE Linux Enterprise Micro 5.0
In the Android kernel in F2FS driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.
ModerateCVE-2019-9445SUSE bug 1172196cpe:/o:suse:suse-microos:5.0CVE-2019-9446SUSE Linux Enterprise Micro 5.0
In the Android kernel in the FingerTipS touchscreen driver there is a possible out of bounds write due to improper input validation. This could lead to a local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
ModerateCVE-2019-9446SUSE bug 1168313cpe:/o:suse:suse-microos:5.0CVE-2019-9447SUSE Linux Enterprise Micro 5.0
In the Android kernel in the FingerTipS touchscreen driver there is a possible use-after-free due to improper locking. This could lead to a local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
ModerateCVE-2019-9447SUSE bug 1168311cpe:/o:suse:suse-microos:5.0CVE-2019-9448SUSE Linux Enterprise Micro 5.0
In the Android kernel in the FingerTipS touchscreen driver there is a possible out of bounds write due to a missing bounds check. This could lead to a local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
ModerateCVE-2019-9448SUSE bug 1168315cpe:/o:suse:suse-microos:5.0CVE-2019-9449SUSE Linux Enterprise Micro 5.0
In the Android kernel in FingerTipS touchscreen driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.
ModerateCVE-2019-9449SUSE bug 1168314cpe:/o:suse:suse-microos:5.0CVE-2019-9450SUSE Linux Enterprise Micro 5.0
In the Android kernel in the FingerTipS touchscreen driver there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
ModerateCVE-2019-9450SUSE bug 1168316cpe:/o:suse:suse-microos:5.0CVE-2019-9453SUSE Linux Enterprise Micro 5.0
In the Android kernel in F2FS touch driver there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.
ModerateCVE-2019-9453SUSE bug 1150028cpe:/o:suse:suse-microos:5.0CVE-2019-9454SUSE Linux Enterprise Micro 5.0
In the Android kernel in i2c driver there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
ModerateCVE-2019-9454SUSE bug 1150023cpe:/o:suse:suse-microos:5.0CVE-2019-9466SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-9503. Reason: This candidate is a duplicate of CVE-2019-9503. Notes: All CVE users should reference CVE-2019-9503 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CriticalCVE-2019-9466SUSE bug 1156653cpe:/o:suse:suse-microos:5.0CVE-2019-9475SUSE Linux Enterprise Micro 5.0
In /proc/net of the kernel filesystem, there is a possible information leak due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-9496886
ModerateCVE-2019-9475SUSE bug 1189429cpe:/o:suse:suse-microos:5.0CVE-2019-9494SUSE Linux Enterprise Micro 5.0
The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
ImportantCVE-2019-9494SUSE bug 1131291SUSE bug 1131868SUSE bug 1194732cpe:/o:suse:suse-microos:5.0CVE-2019-9495SUSE Linux Enterprise Micro 5.0
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
ModerateCVE-2019-9495SUSE bug 1131291SUSE bug 1131870SUSE bug 1194733cpe:/o:suse:suse-microos:5.0CVE-2019-9497SUSE Linux Enterprise Micro 5.0
The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
LowCVE-2019-9497SUSE bug 1131871SUSE bug 1131872SUSE bug 1131874cpe:/o:suse:suse-microos:5.0CVE-2019-9498SUSE Linux Enterprise Micro 5.0
The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
ImportantCVE-2019-9498SUSE bug 1131871SUSE bug 1131872SUSE bug 1131874cpe:/o:suse:suse-microos:5.0CVE-2019-9499SUSE Linux Enterprise Micro 5.0
The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
ImportantCVE-2019-9499SUSE bug 1131871SUSE bug 1131872SUSE bug 1131874cpe:/o:suse:suse-microos:5.0CVE-2019-9511SUSE Linux Enterprise Micro 5.0
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
ImportantCVE-2019-9511SUSE bug 1145579SUSE bug 1146091SUSE bug 1146182SUSE bug 1193427SUSE bug 1202787cpe:/o:suse:suse-microos:5.0CVE-2019-9513SUSE Linux Enterprise Micro 5.0
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
ImportantCVE-2019-9513SUSE bug 1145580SUSE bug 1146094SUSE bug 1146184SUSE bug 1193427SUSE bug 1202787cpe:/o:suse:suse-microos:5.0CVE-2019-9636SUSE Linux Enterprise Micro 5.0
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
ImportantCVE-2019-9636SUSE bug 1129346SUSE bug 1135433SUSE bug 1138459SUSE bug 1145004cpe:/o:suse:suse-microos:5.0CVE-2019-9674SUSE Linux Enterprise Micro 5.0
Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.
ModerateCVE-2019-9674SUSE bug 1162825cpe:/o:suse:suse-microos:5.0CVE-2019-9740SUSE Linux Enterprise Micro 5.0
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
ModerateCVE-2019-9740SUSE bug 1129071SUSE bug 1130840SUSE bug 1132663cpe:/o:suse:suse-microos:5.0CVE-2019-9824SUSE Linux Enterprise Micro 5.0
tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.
LowCVE-2019-9824SUSE bug 1118900SUSE bug 1129622SUSE bug 1129623SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2019-9836SUSE Linux Enterprise Micro 5.0
Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and earlier has an insecure cryptographic implementation.
ModerateCVE-2019-9836SUSE bug 1139383cpe:/o:suse:suse-microos:5.0CVE-2019-9857SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.0.2, the function inotify_update_existing_watch() in fs/notify/inotify/inotify_user.c neglects to call fsnotify_put_mark() with IN_MASK_CREATE after fsnotify_find_mark(), which will cause a memory leak (aka refcount leak). Finally, this will cause a denial of service.
ModerateCVE-2019-9857SUSE bug 1129896cpe:/o:suse:suse-microos:5.0CVE-2019-9893SUSE Linux Enterprise Micro 5.0
libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.
ModerateCVE-2019-9893SUSE bug 1128828cpe:/o:suse:suse-microos:5.0CVE-2019-9923SUSE Linux Enterprise Micro 5.0
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
LowCVE-2019-9923SUSE bug 1130496cpe:/o:suse:suse-microos:5.0CVE-2019-9928SUSE Linux Enterprise Micro 5.0
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
ImportantCVE-2019-9928SUSE bug 1133375cpe:/o:suse:suse-microos:5.0CVE-2019-9936SUSE Linux Enterprise Micro 5.0
In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.
LowCVE-2019-9936SUSE bug 1130326SUSE bug 1154162cpe:/o:suse:suse-microos:5.0CVE-2019-9937SUSE Linux Enterprise Micro 5.0
In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.
LowCVE-2019-9937SUSE bug 1130325SUSE bug 1154162cpe:/o:suse:suse-microos:5.0CVE-2019-9947SUSE Linux Enterprise Micro 5.0
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
ModerateCVE-2019-9947SUSE bug 1130840SUSE bug 1136184SUSE bug 1155094SUSE bug 1201559cpe:/o:suse:suse-microos:5.0CVE-2020-0030SUSE Linux Enterprise Micro 5.0
In binder_thread_release of binder.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145286050References: Upstream kernel
ModerateCVE-2020-0030SUSE bug 1164096cpe:/o:suse:suse-microos:5.0CVE-2020-0067SUSE Linux Enterprise Micro 5.0
In f2fs_xattr_generic_list of xattr.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation.Product: Android. Versions: Android kernel. Android ID: A-120551147.
ModerateCVE-2020-0067SUSE bug 1169391cpe:/o:suse:suse-microos:5.0CVE-2020-0110SUSE Linux Enterprise Micro 5.0
In psi_write of psi.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-148159562References: Upstream kernel
ImportantCVE-2020-0110SUSE bug 1171374SUSE bug 1174874cpe:/o:suse:suse-microos:5.0CVE-2020-0305SUSE Linux Enterprise Micro 5.0
In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-153467744
ModerateCVE-2020-0305SUSE bug 1174462cpe:/o:suse:suse-microos:5.0CVE-2020-0404SUSE Linux Enterprise Micro 5.0
In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-111893654References: Upstream kernel
ModerateCVE-2020-0404SUSE bug 1176423cpe:/o:suse:suse-microos:5.0CVE-2020-0423SUSE Linux Enterprise Micro 5.0
In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-161151868References: N/A
ImportantCVE-2020-0423SUSE bug 1178200cpe:/o:suse:suse-microos:5.0CVE-2020-0427SUSE Linux Enterprise Micro 5.0
In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171
ModerateCVE-2020-0427SUSE bug 1176725cpe:/o:suse:suse-microos:5.0CVE-2020-0431SUSE Linux Enterprise Micro 5.0
In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-144161459
ImportantCVE-2020-0431SUSE bug 1176722SUSE bug 1176896cpe:/o:suse:suse-microos:5.0CVE-2020-0432SUSE Linux Enterprise Micro 5.0
In skb_to_mamac of networking.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-143560807
ImportantCVE-2020-0432SUSE bug 1176721SUSE bug 1177165cpe:/o:suse:suse-microos:5.0CVE-2020-0435SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-14615. Reason: This candidate is a duplicate of CVE-2018-14615. Notes: All CVE users should reference CVE-2018-14615 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
ImportantCVE-2020-0435SUSE bug 1176719SUSE bug 1196027cpe:/o:suse:suse-microos:5.0CVE-2020-0444SUSE Linux Enterprise Micro 5.0
In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150693166References: Upstream kernel
ModerateCVE-2020-0444SUSE bug 1180027SUSE bug 1180028cpe:/o:suse:suse-microos:5.0CVE-2020-0465SUSE Linux Enterprise Micro 5.0
In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-162844689References: Upstream kernel
ImportantCVE-2020-0465SUSE bug 1180029SUSE bug 1180030cpe:/o:suse:suse-microos:5.0CVE-2020-0466SUSE Linux Enterprise Micro 5.0
In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147802478References: Upstream kernel
ImportantCVE-2020-0466SUSE bug 1180031SUSE bug 1180032SUSE bug 1199255SUSE bug 1200084cpe:/o:suse:suse-microos:5.0CVE-2020-0543SUSE Linux Enterprise Micro 5.0
Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
ModerateCVE-2020-0543SUSE bug 1154824SUSE bug 1172205SUSE bug 1172206SUSE bug 1172207SUSE bug 1172770SUSE bug 1178658SUSE bug 1201877cpe:/o:suse:suse-microos:5.0CVE-2020-0548SUSE Linux Enterprise Micro 5.0
Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
ModerateCVE-2020-0548SUSE bug 1156353cpe:/o:suse:suse-microos:5.0CVE-2020-0549SUSE Linux Enterprise Micro 5.0
Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
ModerateCVE-2020-0549SUSE bug 1156353cpe:/o:suse:suse-microos:5.0CVE-2020-0556SUSE Linux Enterprise Micro 5.0
Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access
ModerateCVE-2020-0556SUSE bug 1166751cpe:/o:suse:suse-microos:5.0CVE-2020-10029SUSE Linux Enterprise Micro 5.0
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.
LowCVE-2020-10029SUSE bug 1165784cpe:/o:suse:suse-microos:5.0CVE-2020-10135SUSE Linux Enterprise Micro 5.0
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.
ModerateCVE-2020-10135SUSE bug 1171988cpe:/o:suse:suse-microos:5.0CVE-2020-10543SUSE Linux Enterprise Micro 5.0
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
ModerateCVE-2020-10543SUSE bug 1171863cpe:/o:suse:suse-microos:5.0CVE-2020-10663SUSE Linux Enterprise Micro 5.0
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
ImportantCVE-2020-10663SUSE bug 1167244SUSE bug 1171517cpe:/o:suse:suse-microos:5.0CVE-2020-10690SUSE Linux Enterprise Micro 5.0
There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode.
ModerateCVE-2020-10690SUSE bug 1170056cpe:/o:suse:suse-microos:5.0CVE-2020-10701SUSE Linux Enterprise Micro 5.0
A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set, this flaw can make guest agent commands fail because the agent cannot respond in time. Unprivileged users with a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero, potentially leading to a denial of service. This flaw affects libvirt versions before 6.2.0.
ModerateCVE-2020-10701SUSE bug 1168680cpe:/o:suse:suse-microos:5.0CVE-2020-10702SUSE Linux Enterprise Micro 5.0
A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU.
ModerateCVE-2020-10702SUSE bug 1168681cpe:/o:suse:suse-microos:5.0CVE-2020-10708SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
ModerateCVE-2020-10708SUSE bug 1169737cpe:/o:suse:suse-microos:5.0CVE-2020-10711SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service.
ModerateCVE-2020-10711SUSE bug 1171191cpe:/o:suse:suse-microos:5.0CVE-2020-10713SUSE Linux Enterprise Micro 5.0
A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
ImportantCVE-2020-10713SUSE bug 1168994SUSE bug 1173456SUSE bug 1173812SUSE bug 1199353cpe:/o:suse:suse-microos:5.0CVE-2020-10732SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data.
LowCVE-2020-10732SUSE bug 1171220cpe:/o:suse:suse-microos:5.0CVE-2020-10742SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to crash. In some cases, a reach out of the index after one memory allocation by kmalloc will cause a kernel panic. The highest threat from this vulnerability is to data confidentiality and system availability.
ModerateCVE-2020-10742SUSE bug 1171984cpe:/o:suse:suse-microos:5.0CVE-2020-10749SUSE Linux Enterprise Micro 5.0
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
ModerateCVE-2020-10749SUSE bug 1172375SUSE bug 1172410cpe:/o:suse:suse-microos:5.0CVE-2020-10751SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.
ModerateCVE-2020-10751SUSE bug 1171189SUSE bug 1174963cpe:/o:suse:suse-microos:5.0CVE-2020-10756SUSE Linux Enterprise Micro 5.0
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.
ModerateCVE-2020-10756SUSE bug 1172380SUSE bug 1184743cpe:/o:suse:suse-microos:5.0CVE-2020-10757SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.
ImportantCVE-2020-10757SUSE bug 1159281SUSE bug 1172317SUSE bug 1172437cpe:/o:suse:suse-microos:5.0CVE-2020-10761SUSE Linux Enterprise Micro 5.0
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service.
ImportantCVE-2020-10761SUSE bug 1172710cpe:/o:suse:suse-microos:5.0CVE-2020-10766SUSE Linux Enterprise Micro 5.0
A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.
ModerateCVE-2020-10766SUSE bug 1159281SUSE bug 1172781cpe:/o:suse:suse-microos:5.0CVE-2020-10767SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality.
ModerateCVE-2020-10767SUSE bug 1159281SUSE bug 1172782cpe:/o:suse:suse-microos:5.0CVE-2020-10768SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.
ModerateCVE-2020-10768SUSE bug 1159281SUSE bug 1172783cpe:/o:suse:suse-microos:5.0CVE-2020-10773SUSE Linux Enterprise Micro 5.0
A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the /proc/sys/vm/cmm_timeout file. This flaw allows a local user to see the kernel data.
LowCVE-2020-10773SUSE bug 1172999cpe:/o:suse:suse-microos:5.0CVE-2020-10781SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable.
ModerateCVE-2020-10781SUSE bug 1173074cpe:/o:suse:suse-microos:5.0CVE-2020-10878SUSE Linux Enterprise Micro 5.0
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.
ModerateCVE-2020-10878SUSE bug 1171864cpe:/o:suse:suse-microos:5.0CVE-2020-10933SUSE Linux Enterprise Micro 5.0
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
ModerateCVE-2020-10933SUSE bug 1168938cpe:/o:suse:suse-microos:5.0CVE-2020-10942SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
ModerateCVE-2020-10942SUSE bug 1167629cpe:/o:suse:suse-microos:5.0CVE-2020-11080SUSE Linux Enterprise Micro 5.0
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
ImportantCVE-2020-11080SUSE bug 1172441SUSE bug 1172442SUSE bug 1181358cpe:/o:suse:suse-microos:5.0CVE-2020-11102SUSE Linux Enterprise Micro 5.0
hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r/w data length.
ImportantCVE-2020-11102SUSE bug 1168713cpe:/o:suse:suse-microos:5.0CVE-2020-11494SUSE Linux Enterprise Micro 5.0
An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL, aka CID-b9258a2cece4.
ModerateCVE-2020-11494SUSE bug 1168424cpe:/o:suse:suse-microos:5.0CVE-2020-11501SUSE Linux Enterprise Micro 5.0
GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.
ImportantCVE-2020-11501SUSE bug 1168345cpe:/o:suse:suse-microos:5.0CVE-2020-11608SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d.
ModerateCVE-2020-11608SUSE bug 1168829cpe:/o:suse:suse-microos:5.0CVE-2020-11651SUSE Linux Enterprise Micro 5.0
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
CriticalCVE-2020-11651SUSE bug 1170595cpe:/o:suse:suse-microos:5.0CVE-2020-11652SUSE Linux Enterprise Micro 5.0
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
CriticalCVE-2020-11652SUSE bug 1170595cpe:/o:suse:suse-microos:5.0CVE-2020-11668SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.
ImportantCVE-2020-11668SUSE bug 1168952SUSE bug 1173942cpe:/o:suse:suse-microos:5.0CVE-2020-11739SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the "critical" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.
ImportantCVE-2020-11739SUSE bug 1168142cpe:/o:suse:suse-microos:5.0CVE-2020-11740SUSE Linux Enterprise Micro 5.0
An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests. These buffers were not scrubbed.
ImportantCVE-2020-11740SUSE bug 1168140SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2020-11741SUSE Linux Enterprise Micro 5.0
An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests, cause a denial of service, or possibly gain privileges. For guests for which "active" profiling was enabled by the administrator, the xenoprof code uses the standard Xen shared ring structure. Unfortunately, this code did not treat the guest as a potential adversary: it trusts the guest not to modify buffer size information or modify head / tail pointers in unexpected ways. This can crash the host (DoS). Privilege escalation cannot be ruled out.
ImportantCVE-2020-11741SUSE bug 1168140SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2020-11742SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in GNTTABOP_copy. Grant table operations are expected to return 0 for success, and a negative number for errors. The fix for CVE-2017-12135 introduced a path through grant copy handling where success may be returned to the caller without any action taken. In particular, the status fields of individual operations are left uninitialised, and may result in errant behaviour in the caller of GNTTABOP_copy. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to copy a grant, it hits the incorrect exit path. This returns success to the caller without doing anything, which may cause crashes or other incorrect behaviour.
ModerateCVE-2020-11742SUSE bug 1169392SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2020-11743SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return 0 for success, and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats this condition as success, and proceeds with incorrectly initialised state. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to map a grant, it hits the incorrect error path. This will crash a Linux based dom0 or backend domain.
ModerateCVE-2020-11743SUSE bug 1168143cpe:/o:suse:suse-microos:5.0CVE-2020-11869SUSE Linux Enterprise Micro 5.0
An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
ModerateCVE-2020-11869SUSE bug 1170537SUSE bug 1188609cpe:/o:suse:suse-microos:5.0CVE-2020-11884SUSE Linux Enterprise Micro 5.0
In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade, aka CID-3f777e19d171. A crash could also occur.
ModerateCVE-2020-11884SUSE bug 1170030SUSE bug 1173947cpe:/o:suse:suse-microos:5.0CVE-2020-11935SUSE Linux Enterprise Micro 5.0
It was discovered that aufs improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause a denial of service attack.
ModerateCVE-2020-11935SUSE bug 1173977cpe:/o:suse:suse-microos:5.0CVE-2020-11947SUSE Linux Enterprise Micro 5.0
iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker.
ModerateCVE-2020-11947SUSE bug 1180523cpe:/o:suse:suse-microos:5.0CVE-2020-12049SUSE Linux Enterprise Micro 5.0
An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.
ModerateCVE-2020-12049SUSE bug 1172505cpe:/o:suse:suse-microos:5.0CVE-2020-12243SUSE Linux Enterprise Micro 5.0
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).
ImportantCVE-2020-12243SUSE bug 1170771cpe:/o:suse:suse-microos:5.0CVE-2020-12321SUSE Linux Enterprise Micro 5.0
Improper buffer restriction in some Intel(R) Wireless Bluetooth(R) products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
CriticalCVE-2020-12321SUSE bug 1178671cpe:/o:suse:suse-microos:5.0CVE-2020-12351SUSE Linux Enterprise Micro 5.0
Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
ImportantCVE-2020-12351SUSE bug 1177724SUSE bug 1177729SUSE bug 1178397cpe:/o:suse:suse-microos:5.0CVE-2020-12352SUSE Linux Enterprise Micro 5.0
Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
ModerateCVE-2020-12352SUSE bug 1177725SUSE bug 1178398cpe:/o:suse:suse-microos:5.0CVE-2020-12362SUSE Linux Enterprise Micro 5.0
Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable an escalation of privilege via local access.
ImportantCVE-2020-12362SUSE bug 1181720SUSE bug 1182033SUSE bug 1190859cpe:/o:suse:suse-microos:5.0CVE-2020-12363SUSE Linux Enterprise Micro 5.0
Improper input validation in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable a denial of service via local access.
LowCVE-2020-12363SUSE bug 1181720SUSE bug 1181735cpe:/o:suse:suse-microos:5.0CVE-2020-12364SUSE Linux Enterprise Micro 5.0
Null pointer reference in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before version Linux kernel version 5.5 may allow a privileged user to potentially enable a denial of service via local access.
LowCVE-2020-12364SUSE bug 1181720SUSE bug 1181736cpe:/o:suse:suse-microos:5.0CVE-2020-12373SUSE Linux Enterprise Micro 5.0
Expired pointer dereference in some Intel(R) Graphics Drivers before version 26.20.100.8141 may allow a privileged user to potentially enable a denial of service via local access.
LowCVE-2020-12373SUSE bug 1181720SUSE bug 1181738cpe:/o:suse:suse-microos:5.0CVE-2020-12399SUSE Linux Enterprise Micro 5.0
NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
ModerateCVE-2020-12399SUSE bug 1171978SUSE bug 1172402cpe:/o:suse:suse-microos:5.0CVE-2020-12400SUSE Linux Enterprise Micro 5.0
When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
CriticalCVE-2020-12400SUSE bug 1174763SUSE bug 1175686cpe:/o:suse:suse-microos:5.0CVE-2020-12401SUSE Linux Enterprise Micro 5.0
During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
CriticalCVE-2020-12401SUSE bug 1174763SUSE bug 1175686cpe:/o:suse:suse-microos:5.0CVE-2020-12402SUSE Linux Enterprise Micro 5.0
During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.
ModerateCVE-2020-12402SUSE bug 1173032SUSE bug 1173576SUSE bug 1174230cpe:/o:suse:suse-microos:5.0CVE-2020-12403SUSE Linux Enterprise Micro 5.0
A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.
CriticalCVE-2020-12403SUSE bug 1174763cpe:/o:suse:suse-microos:5.0CVE-2020-12413SUSE Linux Enterprise Micro 5.0
The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites.
ModerateCVE-2020-12413SUSE bug 1176332cpe:/o:suse:suse-microos:5.0CVE-2020-12430SUSE Linux Enterprise Micro 5.0
An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.
ModerateCVE-2020-12430SUSE bug 1170765cpe:/o:suse:suse-microos:5.0CVE-2020-12464SUSE Linux Enterprise Micro 5.0
usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occurs without a reference, aka CID-056ad39ee925.
LowCVE-2020-12464SUSE bug 1170901cpe:/o:suse:suse-microos:5.0CVE-2020-12465SUSE Linux Enterprise Micro 5.0
An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages.
ImportantCVE-2020-12465SUSE bug 1170828SUSE bug 1170888cpe:/o:suse:suse-microos:5.0CVE-2020-12652SUSE Linux Enterprise Micro 5.0
The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect lock during the ioctl operation and trigger a race condition, i.e., a "double fetch" vulnerability, aka CID-28d76df18f0a. NOTE: the vendor states "The security impact of this bug is not as bad as it could have been because these operations are all privileged and root already has enormous destructive power."
ModerateCVE-2020-12652SUSE bug 1171218cpe:/o:suse:suse-microos:5.0CVE-2020-12653SUSE Linux Enterprise Micro 5.0
An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea.
ImportantCVE-2020-12653SUSE bug 1159281SUSE bug 1171195SUSE bug 1171254cpe:/o:suse:suse-microos:5.0CVE-2020-12654SUSE Linux Enterprise Micro 5.0
An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.
ImportantCVE-2020-12654SUSE bug 1159281SUSE bug 1171202SUSE bug 1171252cpe:/o:suse:suse-microos:5.0CVE-2020-12655SUSE Linux Enterprise Micro 5.0
An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka CID-d0c7feaf8767.
LowCVE-2020-12655SUSE bug 1171217cpe:/o:suse:suse-microos:5.0CVE-2020-12656SUSE Linux Enterprise Micro 5.0
** DISPUTED ** gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel through 5.6.10 lacks certain domain_release calls, leading to a memory leak. Note: This was disputed with the assertion that the issue does not grant any access not already available. It is a problem that on unloading a specific kernel module some memory is leaked, but loading kernel modules is a privileged operation. A user could also write a kernel module to consume any amount of memory they like and load that replicating the effect of this bug.
LowCVE-2020-12656SUSE bug 1171219cpe:/o:suse:suse-microos:5.0CVE-2020-12657SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body.
ModerateCVE-2020-12657SUSE bug 1171205SUSE bug 1201585cpe:/o:suse:suse-microos:5.0CVE-2020-12659SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) because of a lack of headroom validation.
ModerateCVE-2020-12659SUSE bug 1171214cpe:/o:suse:suse-microos:5.0CVE-2020-12723SUSE Linux Enterprise Micro 5.0
regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
ModerateCVE-2020-12723SUSE bug 1171866cpe:/o:suse:suse-microos:5.0CVE-2020-12762SUSE Linux Enterprise Micro 5.0
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.
ImportantCVE-2020-12762SUSE bug 1171479SUSE bug 1208644cpe:/o:suse:suse-microos:5.0CVE-2020-12769SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8.
LowCVE-2020-12769SUSE bug 1171983cpe:/o:suse:suse-microos:5.0CVE-2020-12771SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails.
ModerateCVE-2020-12771SUSE bug 1171732cpe:/o:suse:suse-microos:5.0CVE-2020-12825SUSE Linux Enterprise Micro 5.0
libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption.
ImportantCVE-2020-12825SUSE bug 1171685SUSE bug 1203730SUSE bug 1208647cpe:/o:suse:suse-microos:5.0CVE-2020-12829SUSE Linux Enterprise Micro 5.0
In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service.
ModerateCVE-2020-12829SUSE bug 1172385cpe:/o:suse:suse-microos:5.0CVE-2020-12888SUSE Linux Enterprise Micro 5.0
The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space.
ModerateCVE-2020-12888SUSE bug 1159281SUSE bug 1171868SUSE bug 1176979SUSE bug 1179612cpe:/o:suse:suse-microos:5.0CVE-2020-12912SUSE Linux Enterprise Micro 5.0
A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access.
ModerateCVE-2020-12912SUSE bug 1178760cpe:/o:suse:suse-microos:5.0CVE-2020-13143SUSE Linux Enterprise Micro 5.0
gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.
LowCVE-2020-13143SUSE bug 1171982cpe:/o:suse:suse-microos:5.0CVE-2020-13253SUSE Linux Enterprise Micro 5.0
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
LowCVE-2020-13253SUSE bug 1172033cpe:/o:suse:suse-microos:5.0CVE-2020-13361SUSE Linux Enterprise Micro 5.0
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
LowCVE-2020-13361SUSE bug 1172384cpe:/o:suse:suse-microos:5.0CVE-2020-13362SUSE Linux Enterprise Micro 5.0
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.
LowCVE-2020-13362SUSE bug 1172383cpe:/o:suse:suse-microos:5.0CVE-2020-13401SUSE Linux Enterprise Micro 5.0
An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.
ModerateCVE-2020-13401SUSE bug 1172375SUSE bug 1172377cpe:/o:suse:suse-microos:5.0CVE-2020-13434SUSE Linux Enterprise Micro 5.0
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
ModerateCVE-2020-13434SUSE bug 1172115cpe:/o:suse:suse-microos:5.0CVE-2020-13435SUSE Linux Enterprise Micro 5.0
SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.
ImportantCVE-2020-13435SUSE bug 1172091cpe:/o:suse:suse-microos:5.0CVE-2020-13630SUSE Linux Enterprise Micro 5.0
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
ModerateCVE-2020-13630SUSE bug 1172234cpe:/o:suse:suse-microos:5.0CVE-2020-13631SUSE Linux Enterprise Micro 5.0
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.
ModerateCVE-2020-13631SUSE bug 1172236cpe:/o:suse:suse-microos:5.0CVE-2020-13632SUSE Linux Enterprise Micro 5.0
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
ModerateCVE-2020-13632SUSE bug 1172240cpe:/o:suse:suse-microos:5.0CVE-2020-13645SUSE Linux Enterprise Micro 5.0
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
ModerateCVE-2020-13645SUSE bug 1172460cpe:/o:suse:suse-microos:5.0CVE-2020-13659SUSE Linux Enterprise Micro 5.0
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
ModerateCVE-2020-13659SUSE bug 1172386cpe:/o:suse:suse-microos:5.0CVE-2020-13777SUSE Linux Enterprise Micro 5.0
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.
ImportantCVE-2020-13777SUSE bug 1172461SUSE bug 1172506cpe:/o:suse:suse-microos:5.0CVE-2020-13790SUSE Linux Enterprise Micro 5.0
libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.
ModerateCVE-2020-13790SUSE bug 1172491cpe:/o:suse:suse-microos:5.0CVE-2020-13800SUSE Linux Enterprise Micro 5.0
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call.
ModerateCVE-2020-13800SUSE bug 1172495cpe:/o:suse:suse-microos:5.0CVE-2020-13844SUSE Linux Enterprise Micro 5.0
Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka "straight-line speculation."
ModerateCVE-2020-13844SUSE bug 1172798cpe:/o:suse:suse-microos:5.0CVE-2020-13974SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.
ModerateCVE-2020-13974SUSE bug 1172775cpe:/o:suse:suse-microos:5.0CVE-2020-13987SUSE Linux Enterprise Micro 5.0
An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack component when calculating the checksums for IP packets in upper_layer_chksum in net/ipv4/uip.c.
ImportantCVE-2020-13987SUSE bug 1179907SUSE bug 1179908SUSE bug 1193385cpe:/o:suse:suse-microos:5.0CVE-2020-13988SUSE Linux Enterprise Micro 5.0
An issue was discovered in Contiki through 3.0. An Integer Overflow exists in the uIP TCP/IP Stack component when parsing TCP MSS options of IPv4 network packets in uip_process in net/ipv4/uip.c.
ImportantCVE-2020-13988SUSE bug 1179907SUSE bug 1179908SUSE bug 1193385cpe:/o:suse:suse-microos:5.0CVE-2020-14145SUSE Linux Enterprise Micro 5.0
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
ModerateCVE-2020-14145SUSE bug 1173513SUSE bug 1177569SUSE bug 1189078cpe:/o:suse:suse-microos:5.0CVE-2020-14155SUSE Linux Enterprise Micro 5.0
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
ModerateCVE-2020-14155SUSE bug 1172974cpe:/o:suse:suse-microos:5.0CVE-2020-14305SUSE Linux Enterprise Micro 5.0
An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
ModerateCVE-2020-14305SUSE bug 1173346cpe:/o:suse:suse-microos:5.0CVE-2020-14308SUSE Linux Enterprise Micro 5.0
In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process.
ModerateCVE-2020-14308SUSE bug 1168994SUSE bug 1173812cpe:/o:suse:suse-microos:5.0CVE-2020-14309SUSE Linux Enterprise Micro 5.0
There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data.
ModerateCVE-2020-14309SUSE bug 1168994SUSE bug 1173812cpe:/o:suse:suse-microos:5.0CVE-2020-14310SUSE Linux Enterprise Micro 5.0
There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow.
ModerateCVE-2020-14310SUSE bug 1168994SUSE bug 1173812cpe:/o:suse:suse-microos:5.0CVE-2020-14311SUSE Linux Enterprise Micro 5.0
There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow.
ModerateCVE-2020-14311SUSE bug 1168994SUSE bug 1173812cpe:/o:suse:suse-microos:5.0CVE-2020-14312SUSE Linux Enterprise Micro 5.0
A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.
LowCVE-2020-14312SUSE bug 1173646cpe:/o:suse:suse-microos:5.0CVE-2020-14314SUSE Linux Enterprise Micro 5.0
A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.
LowCVE-2020-14314SUSE bug 1173798cpe:/o:suse:suse-microos:5.0CVE-2020-14331SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
ImportantCVE-2020-14331SUSE bug 1174205SUSE bug 1174247cpe:/o:suse:suse-microos:5.0CVE-2020-14339SUSE Linux Enterprise Micro 5.0
A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
ImportantCVE-2020-14339SUSE bug 1174458cpe:/o:suse:suse-microos:5.0CVE-2020-14343SUSE Linux Enterprise Micro 5.0
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
ImportantCVE-2020-14343SUSE bug 1174514cpe:/o:suse:suse-microos:5.0CVE-2020-14344SUSE Linux Enterprise Micro 5.0
An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.
ModerateCVE-2020-14344SUSE bug 1174628SUSE bug 1174638SUSE bug 1175880cpe:/o:suse:suse-microos:5.0CVE-2020-14351SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
ModerateCVE-2020-14351SUSE bug 1177086cpe:/o:suse:suse-microos:5.0CVE-2020-14355SUSE Linux Enterprise Micro 5.0
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.
ModerateCVE-2020-14355SUSE bug 1177158cpe:/o:suse:suse-microos:5.0CVE-2020-14356SUSE Linux Enterprise Micro 5.0
A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.
ModerateCVE-2020-14356SUSE bug 1175213SUSE bug 1176392cpe:/o:suse:suse-microos:5.0CVE-2020-14363SUSE Linux Enterprise Micro 5.0
An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an application compiled with libX11 to crash, or in some cases, result in arbitrary code execution. The highest threat from this flaw is to confidentiality, integrity as well as system availability.
ImportantCVE-2020-14363SUSE bug 1175239cpe:/o:suse:suse-microos:5.0CVE-2020-14364SUSE Linux Enterprise Micro 5.0
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.
ModerateCVE-2020-14364SUSE bug 1175441SUSE bug 1175534SUSE bug 1176494SUSE bug 1177130cpe:/o:suse:suse-microos:5.0CVE-2020-14367SUSE Linux Enterprise Micro 5.0
A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user, and when it's opened for writing, chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing to any destination file in the system, resulting in data loss and a denial of service due to the path traversal.
ModerateCVE-2020-14367SUSE bug 1174911cpe:/o:suse:suse-microos:5.0CVE-2020-14370SUSE Linux Enterprise Micro 5.0
An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.
ModerateCVE-2020-14370SUSE bug 1176804cpe:/o:suse:suse-microos:5.0CVE-2020-14385SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability.
ModerateCVE-2020-14385SUSE bug 1176137cpe:/o:suse:suse-microos:5.0CVE-2020-14386SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.
ImportantCVE-2020-14386SUSE bug 1176069SUSE bug 1176072cpe:/o:suse:suse-microos:5.0CVE-2020-14390SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.
ImportantCVE-2020-14390SUSE bug 1176235SUSE bug 1176253SUSE bug 1176278cpe:/o:suse:suse-microos:5.0CVE-2020-14416SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.4.16, a race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0ace17d56824. This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c.
ModerateCVE-2020-14416SUSE bug 1162002cpe:/o:suse:suse-microos:5.0CVE-2020-14422SUSE Linux Enterprise Micro 5.0
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
ImportantCVE-2020-14422SUSE bug 1173274cpe:/o:suse:suse-microos:5.0CVE-2020-15157SUSE Linux Enterprise Micro 5.0
In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources. Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected.
ModerateCVE-2020-15157SUSE bug 1177598cpe:/o:suse:suse-microos:5.0CVE-2020-15166SUSE Linux Enterprise Micro 5.0
In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.
ImportantCVE-2020-15166SUSE bug 1176116cpe:/o:suse:suse-microos:5.0CVE-2020-15257SUSE Linux Enterprise Micro 5.0
containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.
ImportantCVE-2020-15257SUSE bug 1178969cpe:/o:suse:suse-microos:5.0CVE-2020-15358SUSE Linux Enterprise Micro 5.0
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
ModerateCVE-2020-15358SUSE bug 1173641cpe:/o:suse:suse-microos:5.0CVE-2020-15393SUSE Linux Enterprise Micro 5.0
In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770.
ModerateCVE-2020-15393SUSE bug 1173514cpe:/o:suse:suse-microos:5.0CVE-2020-15436SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.
ModerateCVE-2020-15436SUSE bug 1179141cpe:/o:suse:suse-microos:5.0CVE-2020-15437SUSE Linux Enterprise Micro 5.0
The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allows local users to cause a denial of service by using the p->serial_in pointer which uninitialized.
ModerateCVE-2020-15437SUSE bug 1179140cpe:/o:suse:suse-microos:5.0CVE-2020-15469SUSE Linux Enterprise Micro 5.0
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
ModerateCVE-2020-15469SUSE bug 1173612cpe:/o:suse:suse-microos:5.0CVE-2020-15563SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HVM guest may cause the hypervisor to crash, resulting in Denial of Service (DoS) affecting the entire host. Xen versions from 4.8 onwards are affected. Xen versions 4.7 and earlier are not affected. Only x86 systems are affected. Arm systems are not affected. Only x86 HVM guests using shadow paging can leverage the vulnerability. In addition, there needs to be an entity actively monitoring a guest's video frame buffer (typically for display purposes) in order for such a guest to be able to leverage the vulnerability. x86 PV guests, as well as x86 HVM guests using hardware assisted paging (HAP), cannot leverage the vulnerability.
ModerateCVE-2020-15563SUSE bug 1173377cpe:/o:suse:suse-microos:5.0CVE-2020-15564SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_vcpu_info. The hypercall VCPUOP_register_vcpu_info is used by a guest to register a shared region with the hypervisor. The region will be mapped into Xen address space so it can be directly accessed. On Arm, the region is accessed with instructions that require a specific alignment. Unfortunately, there is no check that the address provided by the guest will be correctly aligned. As a result, a malicious guest could cause a hypervisor crash by passing a misaligned address. A malicious guest administrator may cause a hypervisor crash, resulting in a Denial of Service (DoS). All Xen versions are vulnerable. Only Arm systems are vulnerable. x86 systems are not affected.
ModerateCVE-2020-15564SUSE bug 1173379cpe:/o:suse:suse-microos:5.0CVE-2020-15565SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain privileges because of insufficient cache write-back under VT-d. When page tables are shared between IOMMU and CPU, changes to them require flushing of both TLBs. Furthermore, IOMMUs may be non-coherent, and hence prior to flushing IOMMU TLBs, a CPU cache also needs writing back to memory after changes were made. Such writing back of cached data was missing in particular when splitting large page mappings into smaller granularity ones. A malicious guest may be able to retain read/write DMA access to frames returned to Xen's free pool, and later reused for another purpose. Host crashes (leading to a Denial of Service) and privilege escalation cannot be ruled out. Xen versions from at least 3.2 onwards are affected. Only x86 Intel systems are affected. x86 AMD as well as Arm systems are not affected. Only x86 HVM guests using hardware assisted paging (HAP), having a passed through PCI device assigned, and having page table sharing enabled can leverage the vulnerability. Note that page table sharing will be enabled (by default) only if Xen considers IOMMU and CPU large page size support compatible.
ImportantCVE-2020-15565SUSE bug 1173378cpe:/o:suse:suse-microos:5.0CVE-2020-15566SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: (1) port is already in use, (2) the memory allocation failed, or (3) the port we try to allocate is higher than what is supported by the ABI (e.g., 2L or FIFO) used by the guest or the limit set by an administrator (max_event_channels in xl cfg). Due to the missing error checks, only (1) will be considered an error. All the other cases will provide a valid port and will result in a crash when trying to access the event channel. When the administrator configured a guest to allow more than 1023 event channels, that guest may be able to crash the host. When Xen is out-of-memory, allocation of new event channels will result in crashing the host rather than reporting an error. Xen versions 4.10 and later are affected. All architectures are affected. The default configuration, when guests are created with xl/libxl, is not vulnerable, because of the default event-channel limit.
ModerateCVE-2020-15566SUSE bug 1173376cpe:/o:suse:suse-microos:5.0CVE-2020-15567SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not vulnerable. Only systems using nested paging (hap, aka nested paging, aka in this case Intel EPT) are vulnerable. Only HVM and PVH guests can exploit the vulnerability. The presence and scope of the vulnerability depends on the precise optimisations performed by the compiler used to build Xen. If the compiler generates (a) a single 64-bit write, or (b) a series of read-modify-write operations in the same order as the source code, the hypervisor is not vulnerable. For example, in one test build using GCC 8.3 with normal settings, the compiler generated multiple (unlocked) read-modify-write operations in source-code order, which did not constitute a vulnerability. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code-generation options). The source code clearly violates the C rules, and thus should be considered vulnerable.
ModerateCVE-2020-15567SUSE bug 1173380SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2020-15705SUSE Linux Enterprise Micro 5.0
GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.
ImportantCVE-2020-15705SUSE bug 1174421SUSE bug 1182890cpe:/o:suse:suse-microos:5.0CVE-2020-15706SUSE Linux Enterprise Micro 5.0
GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.
ModerateCVE-2020-15706SUSE bug 1174463cpe:/o:suse:suse-microos:5.0CVE-2020-15707SUSE Linux Enterprise Micro 5.0
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.
ImportantCVE-2020-15707SUSE bug 1174570cpe:/o:suse:suse-microos:5.0CVE-2020-15708SUSE Linux Enterprise Micro 5.0
Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.
ImportantCVE-2020-15708SUSE bug 1174955cpe:/o:suse:suse-microos:5.0CVE-2020-15719SUSE Linux Enterprise Micro 5.0
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.
ModerateCVE-2020-15719SUSE bug 1174154cpe:/o:suse:suse-microos:5.0CVE-2020-15780SUSE Linux Enterprise Micro 5.0
An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.
ImportantCVE-2020-15780SUSE bug 1173573SUSE bug 1174186cpe:/o:suse:suse-microos:5.0CVE-2020-15852SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tss_invalidate_io_bitmap mishandling causes a loss of synchronization between the I/O bitmaps of TSS and Xen, aka CID-cadfad870154.
ModerateCVE-2020-15852SUSE bug 1174063cpe:/o:suse:suse-microos:5.0CVE-2020-15859SUSE Linux Enterprise Micro 5.0
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.
LowCVE-2020-15859SUSE bug 1174373cpe:/o:suse:suse-microos:5.0CVE-2020-15863SUSE Linux Enterprise Micro 5.0
hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555.
ImportantCVE-2020-15863SUSE bug 1174386cpe:/o:suse:suse-microos:5.0CVE-2020-15888SUSE Linux Enterprise Micro 5.0
Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.
ImportantCVE-2020-15888SUSE bug 1174367cpe:/o:suse:suse-microos:5.0CVE-2020-15999SUSE Linux Enterprise Micro 5.0
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
ImportantCVE-2020-15999SUSE bug 1177914SUSE bug 1177936SUSE bug 1178824SUSE bug 1178894cpe:/o:suse:suse-microos:5.0CVE-2020-16092SUSE Linux Enterprise Micro 5.0
In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c.
LowCVE-2020-16092SUSE bug 1174641cpe:/o:suse:suse-microos:5.0CVE-2020-16119SUSE Linux Enterprise Micro 5.0
Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
ImportantCVE-2020-16119SUSE bug 1177471SUSE bug 1177742cpe:/o:suse:suse-microos:5.0CVE-2020-16120SUSE Linux Enterprise Micro 5.0
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack file ops"). This was fixed in kernel version 5.8 by commits 56230d9 ("ovl: verify permissions in ovl_path_open()"), 48bd024 ("ovl: switch to mounter creds in readdir") and 05acefb ("ovl: check permission to open real file"). Additionally, commits 130fdbc ("ovl: pass correct flags for opening real directory") and 292f902 ("ovl: call secutiry hook in ovl_real_ioctl()") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da ("ovl: do not fail because of O_NOATIMEi") in kernel 5.11.
ModerateCVE-2020-16120SUSE bug 1177470cpe:/o:suse:suse-microos:5.0CVE-2020-16155SUSE Linux Enterprise Micro 5.0
The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data.
ModerateCVE-2020-16155SUSE bug 1193811cpe:/o:suse:suse-microos:5.0CVE-2020-16166SUSE Linux Enterprise Micro 5.0
The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.
ModerateCVE-2020-16166SUSE bug 1174757cpe:/o:suse:suse-microos:5.0CVE-2020-16846SUSE Linux Enterprise Micro 5.0
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
CriticalCVE-2020-16846SUSE bug 1178361cpe:/o:suse:suse-microos:5.0CVE-2020-1711SUSE Linux Enterprise Micro 5.0
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
ImportantCVE-2020-1711SUSE bug 1166240cpe:/o:suse:suse-microos:5.0CVE-2020-1712SUSE Linux Enterprise Micro 5.0
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
ImportantCVE-2020-1712SUSE bug 1162108cpe:/o:suse:suse-microos:5.0CVE-2020-1726SUSE Linux Enterprise Micro 5.0
A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
ModerateCVE-2020-1726SUSE bug 1164090cpe:/o:suse:suse-microos:5.0CVE-2020-1730SUSE Linux Enterprise Micro 5.0
A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
ModerateCVE-2020-1730SUSE bug 1168699cpe:/o:suse:suse-microos:5.0CVE-2020-17437SUSE Linux Enterprise Micro 5.0
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.
ImportantCVE-2020-17437SUSE bug 1179907SUSE bug 1179908cpe:/o:suse:suse-microos:5.0CVE-2020-17438SUSE Linux Enterprise Micro 5.0
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.
ImportantCVE-2020-17438SUSE bug 1179907SUSE bug 1179908cpe:/o:suse:suse-microos:5.0CVE-2020-1747SUSE Linux Enterprise Micro 5.0
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
ImportantCVE-2020-1747SUSE bug 1165439SUSE bug 1174514cpe:/o:suse:suse-microos:5.0CVE-2020-1749SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.
ImportantCVE-2020-1749SUSE bug 1165629SUSE bug 1165631SUSE bug 1177511SUSE bug 1177513SUSE bug 1189302cpe:/o:suse:suse-microos:5.0CVE-2020-17490SUSE Linux Enterprise Micro 5.0
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
ModerateCVE-2020-17490SUSE bug 1178362cpe:/o:suse:suse-microos:5.0CVE-2020-1751SUSE Linux Enterprise Micro 5.0
An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.
ModerateCVE-2020-1751SUSE bug 1167630cpe:/o:suse:suse-microos:5.0CVE-2020-1752SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.
ModerateCVE-2020-1752SUSE bug 1167631cpe:/o:suse:suse-microos:5.0CVE-2020-17541SUSE Linux Enterprise Micro 5.0
Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.
ImportantCVE-2020-17541SUSE bug 1186764cpe:/o:suse:suse-microos:5.0CVE-2020-1967SUSE Linux Enterprise Micro 5.0
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
ImportantCVE-2020-1967SUSE bug 1169407cpe:/o:suse:suse-microos:5.0CVE-2020-1971SUSE Linux Enterprise Micro 5.0
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).
ImportantCVE-2020-1971SUSE bug 1179491SUSE bug 1196179SUSE bug 1199303cpe:/o:suse:suse-microos:5.0CVE-2020-1983SUSE Linux Enterprise Micro 5.0
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
ImportantCVE-2020-1983SUSE bug 1170940cpe:/o:suse:suse-microos:5.0CVE-2020-24352SUSE Linux Enterprise Micro 5.0
An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
LowCVE-2020-24352SUSE bug 1175370SUSE bug 1188609cpe:/o:suse:suse-microos:5.0CVE-2020-24370SUSE Linux Enterprise Micro 5.0
ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).
LowCVE-2020-24370SUSE bug 1175448cpe:/o:suse:suse-microos:5.0CVE-2020-24371SUSE Linux Enterprise Micro 5.0
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
ModerateCVE-2020-24371SUSE bug 1175449cpe:/o:suse:suse-microos:5.0CVE-2020-24489SUSE Linux Enterprise Micro 5.0
Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access.
ImportantCVE-2020-24489SUSE bug 1179839SUSE bug 1192359SUSE bug 1199300SUSE bug 1201731cpe:/o:suse:suse-microos:5.0CVE-2020-24490SUSE Linux Enterprise Micro 5.0
Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access. This affects all Linux kernel versions that support BlueZ.
ImportantCVE-2020-24490SUSE bug 1177726SUSE bug 1177727cpe:/o:suse:suse-microos:5.0CVE-2020-24502SUSE Linux Enterprise Micro 5.0
Improper input validation in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 and before version 1.4.29.0 for Windows*, may allow an authenticated user to potentially enable a denial of service via local access.
LowCVE-2020-24502SUSE bug 1182409cpe:/o:suse:suse-microos:5.0CVE-2020-24503SUSE Linux Enterprise Micro 5.0
Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 may allow an authenticated user to potentially enable information disclosure via local access.
LowCVE-2020-24503SUSE bug 1182405cpe:/o:suse:suse-microos:5.0CVE-2020-24504SUSE Linux Enterprise Micro 5.0
Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 may allow an authenticated user to potentially enable denial of service via local access.
ModerateCVE-2020-24504SUSE bug 1182404cpe:/o:suse:suse-microos:5.0CVE-2020-24511SUSE Linux Enterprise Micro 5.0
Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
ModerateCVE-2020-24511SUSE bug 1179836SUSE bug 1192360SUSE bug 1199300SUSE bug 1201731cpe:/o:suse:suse-microos:5.0CVE-2020-24512SUSE Linux Enterprise Micro 5.0
Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
LowCVE-2020-24512SUSE bug 1179837SUSE bug 1192360SUSE bug 1199300SUSE bug 1201731cpe:/o:suse:suse-microos:5.0CVE-2020-24513SUSE Linux Enterprise Micro 5.0
Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
ModerateCVE-2020-24513SUSE bug 1179833SUSE bug 1192360SUSE bug 1199300SUSE bug 1201731cpe:/o:suse:suse-microos:5.0CVE-2020-24586SUSE Linux Enterprise Micro 5.0
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
ModerateCVE-2020-24586SUSE bug 1185859SUSE bug 1192868cpe:/o:suse:suse-microos:5.0CVE-2020-24587SUSE Linux Enterprise Micro 5.0
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.
ModerateCVE-2020-24587SUSE bug 1185859SUSE bug 1185862SUSE bug 1192868cpe:/o:suse:suse-microos:5.0CVE-2020-24588SUSE Linux Enterprise Micro 5.0
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.
ModerateCVE-2020-24588SUSE bug 1185861SUSE bug 1192868SUSE bug 1199701cpe:/o:suse:suse-microos:5.0CVE-2020-24659SUSE Linux Enterprise Micro 5.0
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.
ModerateCVE-2020-24659SUSE bug 1176181SUSE bug 1178057cpe:/o:suse:suse-microos:5.0CVE-2020-24977SUSE Linux Enterprise Micro 5.0
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.
ModerateCVE-2020-24977SUSE bug 1176179SUSE bug 1191860cpe:/o:suse:suse-microos:5.0CVE-2020-25084SUSE Linux Enterprise Micro 5.0
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
ModerateCVE-2020-25084SUSE bug 1176673cpe:/o:suse:suse-microos:5.0CVE-2020-25085SUSE Linux Enterprise Micro 5.0
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.
ModerateCVE-2020-25085SUSE bug 1176681SUSE bug 1182282cpe:/o:suse:suse-microos:5.0CVE-2020-2521SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
LowCVE-2020-2521cpe:/o:suse:suse-microos:5.0CVE-2020-25211SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.
ModerateCVE-2020-25211SUSE bug 1176395SUSE bug 1192356cpe:/o:suse:suse-microos:5.0CVE-2020-25212SUSE Linux Enterprise Micro 5.0
A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.
ImportantCVE-2020-25212SUSE bug 1176381SUSE bug 1176382SUSE bug 1177027cpe:/o:suse:suse-microos:5.0CVE-2020-25219SUSE Linux Enterprise Micro 5.0
url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion.
ImportantCVE-2020-25219SUSE bug 1176410cpe:/o:suse:suse-microos:5.0CVE-2020-25220SUSE Linux Enterprise Micro 5.0
The Linux kernel 4.9.x before 4.9.233, 4.14.x before 4.14.194, and 4.19.x before 4.19.140 has a use-after-free because skcd->no_refcnt was not considered during a backport of a CVE-2020-14356 patch. This is related to the cgroups feature.
ModerateCVE-2020-25220SUSE bug 1176392cpe:/o:suse:suse-microos:5.0CVE-2020-25221SUSE Linux Enterprise Micro 5.0
get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd946743.
ImportantCVE-2020-25221SUSE bug 1176286cpe:/o:suse:suse-microos:5.0CVE-2020-25284SUSE Linux Enterprise Micro 5.0
The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe.
ModerateCVE-2020-25284SUSE bug 1176482cpe:/o:suse:suse-microos:5.0CVE-2020-25285SUSE Linux Enterprise Micro 5.0
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.
ModerateCVE-2020-25285SUSE bug 1176485cpe:/o:suse:suse-microos:5.0CVE-2020-25592SUSE Linux Enterprise Micro 5.0
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.
CriticalCVE-2020-25592SUSE bug 1178319cpe:/o:suse:suse-microos:5.0CVE-2020-25595SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified that act on unsanitized values read back from device hardware registers. While devices strictly compliant with PCI specifications shouldn't be able to affect these registers, experience shows that it's very common for devices to have out-of-spec "backdoor" operations that can affect the result of these reads. A not fully trusted guest may be able to crash Xen, leading to a Denial of Service (DoS) for the entire system. Privilege escalation and information leaks cannot be excluded. All versions of Xen supporting PCI passthrough are affected. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only guests with passed through PCI devices may be able to leverage the vulnerability. Only systems passing through devices with out-of-spec ("backdoor") functionality can cause issues. Experience shows that such out-of-spec functionality is common; unless you have reason to believe that your device does not have such functionality, it's better to assume that it does.
ImportantCVE-2020-25595SUSE bug 1176344SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2020-25596SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. This causes the guest kernel to observe a kernel-privilege #GP fault (typically fatal) rather than a user-privilege #GP fault (usually converted into SIGSEGV/etc.). Malicious or buggy userspace can crash the guest kernel, resulting in a VM Denial of Service. All versions of Xen from 3.2 onwards are vulnerable. Only x86 systems are vulnerable. ARM platforms are not vulnerable. Only x86 systems that support the SYSENTER instruction in 64bit mode are vulnerable. This is believed to be Intel, Centaur, and Shanghai CPUs. AMD and Hygon CPUs are not believed to be vulnerable. Only x86 PV guests can exploit the vulnerability. x86 PVH / HVM guests cannot exploit the vulnerability.
ModerateCVE-2020-25596SUSE bug 1176345SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2020-25597SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. However, operations like the resetting of all event channels may involve decreasing one of the bounds checked when determining validity. This may lead to bug checks triggering, crashing the host. An unprivileged guest may be able to crash Xen, leading to a Denial of Service (DoS) for the entire system. All Xen versions from 4.4 onwards are vulnerable. Xen versions 4.3 and earlier are not vulnerable. Only systems with untrusted guests permitted to create more than the default number of event channels are vulnerable. This number depends on the architecture and type of guest. For 32-bit x86 PV guests, this is 1023; for 64-bit x86 PV guests, and for all ARM guests, this number is 4095. Systems where untrusted guests are limited to fewer than this number are not vulnerable. Note that xl and libxl limit max_event_channels to 1023 by default, so systems using exclusively xl, libvirt+libxl, or their own toolstack based on libxl, and not explicitly setting max_event_channels, are not vulnerable.
ModerateCVE-2020-25597SUSE bug 1176346cpe:/o:suse:suse-microos:5.0CVE-2020-25598SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU reference to be leaked. This causes subsequent administration operations, (e.g., CPU offline) to livelock, resulting in a host Denial of Service. The buggy codepath has been present since Xen 4.12. Xen 4.14 and later are vulnerable to the DoS. The side effects are believed to be benign on Xen 4.12 and 4.13, but patches are provided nevertheless. The vulnerability can generally only be exploited by x86 HVM VMs, as these are generally the only type of VM that have a Qemu stubdomain. x86 PV and PVH domains, as well as ARM VMs, typically don't use a stubdomain. Only VMs using HVM stubdomains can exploit the vulnerability. VMs using PV stubdomains, or with emulators running in dom0, cannot exploit the vulnerability.
ModerateCVE-2020-25598SUSE bug 1176341cpe:/o:suse:suse-microos:5.0CVE-2020-25599SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77) can lead to the violation of various internal assumptions. This may lead to out of bounds memory accesses or triggering of bug checks. In particular, x86 PV guests may be able to elevate their privilege to that of the host. Host and guest crashes are also possible, leading to a Denial of Service (DoS). Information leaks cannot be ruled out. All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and earlier are not vulnerable.
ImportantCVE-2020-25599SUSE bug 1176349cpe:/o:suse:suse-microos:5.0CVE-2020-25600SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level event channel model imposes different limits on the number of usable event channels for 32-bit x86 domains vs 64-bit or Arm (either bitness) ones. 32-bit x86 domains can use only 1023 channels, due to limited space in their shared (between guest and Xen) information structure, whereas all other domains can use up to 4095 in this model. The recording of the respective limit during domain initialization, however, has occurred at a time where domains are still deemed to be 64-bit ones, prior to actually honoring respective domain properties. At the point domains get recognized as 32-bit ones, the limit didn't get updated accordingly. Due to this misbehavior in Xen, 32-bit domains (including Domain 0) servicing other domains may observe event channel allocations to succeed when they should really fail. Subsequent use of such event channels would then possibly lead to corruption of other parts of the shared info structure. An unprivileged guest may cause another domain, in particular Domain 0, to misbehave. This may lead to a Denial of Service (DoS) for the entire system. All Xen versions from 4.4 onwards are vulnerable. Xen versions 4.3 and earlier are not vulnerable. Only x86 32-bit domains servicing other domains are vulnerable. Arm systems, as well as x86 64-bit domains, are not vulnerable.
ImportantCVE-2020-25600SUSE bug 1176348cpe:/o:suse:suse-microos:5.0CVE-2020-25601SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() / evtchn_destroy(). In particular, the FIFO event channel model allows guests to have a large number of event channels active at a time. Closing all of these (when resetting all event channels or when cleaning up after the guest) may take extended periods of time. So far, there was no arrangement for preemption at suitable intervals, allowing a CPU to spend an almost unbounded amount of time in the processing of these operations. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system. All Xen versions are vulnerable in principle. Whether versions 4.3 and older are vulnerable depends on underlying hardware characteristics.
ModerateCVE-2020-25601SUSE bug 1176350cpe:/o:suse:suse-microos:5.0CVE-2020-25602SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE. When a guest accesses certain Model Specific Registers, Xen first reads the value from hardware to use as the basis for auditing the guest access. For the MISC_ENABLE MSR, which is an Intel specific MSR, this MSR read is performed without error handling for a #GP fault, which is the consequence of trying to read this MSR on non-Intel hardware. A buggy or malicious PV guest administrator can crash Xen, resulting in a host Denial of Service. Only x86 systems are vulnerable. ARM systems are not vulnerable. Only Xen versions 4.11 and onwards are vulnerable. 4.10 and earlier are not vulnerable. Only x86 systems that do not implement the MISC_ENABLE MSR (0x1a0) are vulnerable. AMD and Hygon systems do not implement this MSR and are vulnerable. Intel systems do implement this MSR and are not vulnerable. Other manufacturers have not been checked. Only x86 PV guests can exploit the vulnerability. x86 HVM/PVH guests cannot exploit the vulnerability.
ModerateCVE-2020-25602SUSE bug 1176339cpe:/o:suse:suse-microos:5.0CVE-2020-25603SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.
ImportantCVE-2020-25603SUSE bug 1176347SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2020-25604SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests between its vCPUs, the locking model used allows for a second vCPU of the same guest (also operating on the timers) to release a lock that it didn't acquire. The most likely effect of the issue is a hang or crash of the hypervisor, i.e., a Denial of Service (DoS). All versions of Xen are affected. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only x86 HVM guests can leverage the vulnerability. x86 PV and PVH cannot leverage the vulnerability. Only guests with more than one vCPU can exploit the vulnerability.
ModerateCVE-2020-25604SUSE bug 1176343SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2020-25613SUSE Linux Enterprise Micro 5.0
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
ModerateCVE-2020-25613SUSE bug 1177125cpe:/o:suse:suse-microos:5.0CVE-2020-25624SUSE Linux Enterprise Micro 5.0
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.
ModerateCVE-2020-25624SUSE bug 1176682cpe:/o:suse:suse-microos:5.0CVE-2020-25625SUSE Linux Enterprise Micro 5.0
hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.
LowCVE-2020-25625SUSE bug 1176684cpe:/o:suse:suse-microos:5.0CVE-2020-25637SUSE Linux Enterprise Micro 5.0
A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
ImportantCVE-2020-25637SUSE bug 1174955SUSE bug 1177155cpe:/o:suse:suse-microos:5.0CVE-2020-25639SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to crash the system.
ModerateCVE-2020-25639SUSE bug 1176846cpe:/o:suse:suse-microos:5.0CVE-2020-25641SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
ModerateCVE-2020-25641SUSE bug 1177121cpe:/o:suse:suse-microos:5.0CVE-2020-25643SUSE Linux Enterprise Micro 5.0
A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
ImportantCVE-2020-25643SUSE bug 1177206SUSE bug 1177226cpe:/o:suse:suse-microos:5.0CVE-2020-25645SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.
ImportantCVE-2020-25645SUSE bug 1177511SUSE bug 1177513cpe:/o:suse:suse-microos:5.0CVE-2020-25648SUSE Linux Enterprise Micro 5.0
A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.
ImportantCVE-2020-25648SUSE bug 1177917cpe:/o:suse:suse-microos:5.0CVE-2020-25656SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
ModerateCVE-2020-25656SUSE bug 1177766cpe:/o:suse:suse-microos:5.0CVE-2020-25659SUSE Linux Enterprise Micro 5.0
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
ModerateCVE-2020-25659SUSE bug 1178168cpe:/o:suse:suse-microos:5.0CVE-2020-25661SUSE Linux Enterprise Micro 5.0
A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with A2MP CID. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or potentially executing arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
ImportantCVE-2020-25661SUSE bug 1178397cpe:/o:suse:suse-microos:5.0CVE-2020-25662SUSE Linux Enterprise Micro 5.0
A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initialization of stack memory when handling certain AMP packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the system by sending specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality.
ModerateCVE-2020-25662SUSE bug 1178398cpe:/o:suse:suse-microos:5.0CVE-2020-25668SUSE Linux Enterprise Micro 5.0
A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op.
ModerateCVE-2020-25668SUSE bug 1178123SUSE bug 1178622SUSE bug 1196914cpe:/o:suse:suse-microos:5.0CVE-2020-25669SUSE Linux Enterprise Micro 5.0
A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.
ModerateCVE-2020-25669SUSE bug 1178182cpe:/o:suse:suse-microos:5.0CVE-2020-25670SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free which might lead to privilege escalations.
ImportantCVE-2020-25670SUSE bug 1178181SUSE bug 1194680cpe:/o:suse:suse-microos:5.0CVE-2020-25671SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which might lead to privilege escalations.
ImportantCVE-2020-25671SUSE bug 1178181cpe:/o:suse:suse-microos:5.0CVE-2020-25672SUSE Linux Enterprise Micro 5.0
A memory leak vulnerability was found in Linux kernel in llcp_sock_connect
ImportantCVE-2020-25672SUSE bug 1178181cpe:/o:suse:suse-microos:5.0CVE-2020-25673SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak and eventually hanging-up the system.
ImportantCVE-2020-25673SUSE bug 1178181cpe:/o:suse:suse-microos:5.0CVE-2020-25692SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.
ImportantCVE-2020-25692SUSE bug 1178387cpe:/o:suse:suse-microos:5.0CVE-2020-25704SUSE Linux Enterprise Micro 5.0
A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.
ModerateCVE-2020-25704SUSE bug 1178393cpe:/o:suse:suse-microos:5.0CVE-2020-25705SUSE Linux Enterprise Micro 5.0
A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version
ImportantCVE-2020-25705SUSE bug 1175721SUSE bug 1178782SUSE bug 1178783SUSE bug 1191790cpe:/o:suse:suse-microos:5.0CVE-2020-25707SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate is a duplicate of CVE-2020-28916
ModerateCVE-2020-25707SUSE bug 1178683SUSE bug 1179468cpe:/o:suse:suse-microos:5.0CVE-2020-25709SUSE Linux Enterprise Micro 5.0
A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.
ModerateCVE-2020-25709SUSE bug 1178909cpe:/o:suse:suse-microos:5.0CVE-2020-25710SUSE Linux Enterprise Micro 5.0
A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.
ModerateCVE-2020-25710SUSE bug 1178909cpe:/o:suse:suse-microos:5.0CVE-2020-25723SUSE Linux Enterprise Micro 5.0
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
LowCVE-2020-25723SUSE bug 1178934SUSE bug 1178935cpe:/o:suse:suse-microos:5.0CVE-2020-26088SUSE Linux Enterprise Micro 5.0
A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a.
ModerateCVE-2020-26088SUSE bug 1176990cpe:/o:suse:suse-microos:5.0CVE-2020-26116SUSE Linux Enterprise Micro 5.0
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
ModerateCVE-2020-26116SUSE bug 1177120SUSE bug 1177211SUSE bug 1192361cpe:/o:suse:suse-microos:5.0CVE-2020-26137SUSE Linux Enterprise Micro 5.0
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
ModerateCVE-2020-26137SUSE bug 1177120SUSE bug 1177211cpe:/o:suse:suse-microos:5.0CVE-2020-26139SUSE Linux Enterprise Micro 5.0
An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier to exploit other vulnerabilities in connected clients.
ModerateCVE-2020-26139SUSE bug 1186062SUSE bug 1192868cpe:/o:suse:suse-microos:5.0CVE-2020-26141SUSE Linux Enterprise Micro 5.0
An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol.
ModerateCVE-2020-26141SUSE bug 1185987cpe:/o:suse:suse-microos:5.0CVE-2020-26145SUSE Linux Enterprise Micro 5.0
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
ModerateCVE-2020-26145SUSE bug 1185860cpe:/o:suse:suse-microos:5.0CVE-2020-26147SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used.
ModerateCVE-2020-26147cpe:/o:suse:suse-microos:5.0CVE-2020-26154SUSE Linux Enterprise Micro 5.0
url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header.
ImportantCVE-2020-26154SUSE bug 1177143cpe:/o:suse:suse-microos:5.0CVE-2020-26558SUSE Linux Enterprise Micro 5.0
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.
ModerateCVE-2020-26558SUSE bug 1179610SUSE bug 1186463cpe:/o:suse:suse-microos:5.0CVE-2020-27068SUSE Linux Enterprise Micro 5.0
Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstream kernel
ModerateCVE-2020-27068SUSE bug 1180086cpe:/o:suse:suse-microos:5.0CVE-2020-27152SUSE Linux Enterprise Micro 5.0
An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9.
ModerateCVE-2020-27152SUSE bug 1177785cpe:/o:suse:suse-microos:5.0CVE-2020-27153SUSE Linux Enterprise Micro 5.0
In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event.
ModerateCVE-2020-27153SUSE bug 1177895cpe:/o:suse:suse-microos:5.0CVE-2020-27170SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit.
ModerateCVE-2020-27170SUSE bug 1183686SUSE bug 1183775cpe:/o:suse:suse-microos:5.0CVE-2020-27171SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d.
ModerateCVE-2020-27171SUSE bug 1183686SUSE bug 1183775cpe:/o:suse:suse-microos:5.0CVE-2020-27194SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values, aka CID-5b9fbeb75b6a.
ModerateCVE-2020-27194SUSE bug 1177889cpe:/o:suse:suse-microos:5.0CVE-2020-2732SUSE Linux Enterprise Micro 5.0
A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest.
LowCVE-2020-2732SUSE bug 1163971cpe:/o:suse:suse-microos:5.0CVE-2020-27418SUSE Linux Enterprise Micro 5.0
A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers to obatin sensitive information via vgacon_invert_region() function.
ModerateCVE-2020-27418SUSE bug 1214919cpe:/o:suse:suse-microos:5.0CVE-2020-27616SUSE Linux Enterprise Micro 5.0
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
LowCVE-2020-27616SUSE bug 1178400SUSE bug 1188609cpe:/o:suse:suse-microos:5.0CVE-2020-27617SUSE Linux Enterprise Micro 5.0
eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.
ModerateCVE-2020-27617SUSE bug 1178174cpe:/o:suse:suse-microos:5.0CVE-2020-27619SUSE Linux Enterprise Micro 5.0
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
ImportantCVE-2020-27619SUSE bug 1178009SUSE bug 1180254SUSE bug 1193386cpe:/o:suse:suse-microos:5.0CVE-2020-27670SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated.
ImportantCVE-2020-27670SUSE bug 1177414SUSE bug 1178658SUSE bug 1183925cpe:/o:suse:suse-microos:5.0CVE-2020-27671SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because coalescing of per-page IOMMU TLB flushes is mishandled.
ImportantCVE-2020-27671SUSE bug 1177413SUSE bug 1183925cpe:/o:suse:suse-microos:5.0CVE-2020-27672SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privileges by exploiting a race condition that leads to a use-after-free involving 2MiB and 1GiB superpages.
ImportantCVE-2020-27672SUSE bug 1177412SUSE bug 1178658SUSE bug 1183925cpe:/o:suse:suse-microos:5.0CVE-2020-27673SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.
ModerateCVE-2020-27673SUSE bug 1177411SUSE bug 1184583cpe:/o:suse:suse-microos:5.0CVE-2020-27674SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique.
ModerateCVE-2020-27674SUSE bug 1177409SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2020-27675SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5.
ModerateCVE-2020-27675SUSE bug 1177410cpe:/o:suse:suse-microos:5.0CVE-2020-27777SUSE Linux Enterprise Micro 5.0
A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.
ModerateCVE-2020-27777SUSE bug 1179107SUSE bug 1179419SUSE bug 1200343cpe:/o:suse:suse-microos:5.0CVE-2020-27784SUSE Linux Enterprise Micro 5.0
A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had been freed by gprinter_free().
LowCVE-2020-27784SUSE bug 1202895cpe:/o:suse:suse-microos:5.0CVE-2020-27786SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
ImportantCVE-2020-27786SUSE bug 1179601SUSE bug 1179616cpe:/o:suse:suse-microos:5.0CVE-2020-27815SUSE Linux Enterprise Micro 5.0
A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
ImportantCVE-2020-27815SUSE bug 1179454SUSE bug 1179458cpe:/o:suse:suse-microos:5.0CVE-2020-27820SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver).
LowCVE-2020-27820SUSE bug 1179599cpe:/o:suse:suse-microos:5.0CVE-2020-27821SUSE Linux Enterprise Micro 5.0
A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0.
ModerateCVE-2020-27821SUSE bug 1179686cpe:/o:suse:suse-microos:5.0CVE-2020-27825SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat.
ImportantCVE-2020-27825SUSE bug 1179960SUSE bug 1179961cpe:/o:suse:suse-microos:5.0CVE-2020-27830SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash.
ModerateCVE-2020-27830SUSE bug 1179656cpe:/o:suse:suse-microos:5.0CVE-2020-27835SUSE Linux Enterprise Micro 5.0
A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system.
ModerateCVE-2020-27835SUSE bug 1179878cpe:/o:suse:suse-microos:5.0CVE-2020-28196SUSE Linux Enterprise Micro 5.0
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
ImportantCVE-2020-28196SUSE bug 1178512SUSE bug 1183911cpe:/o:suse:suse-microos:5.0CVE-2020-28243SUSE Linux Enterprise Micro 5.0
An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.
ImportantCVE-2020-28243SUSE bug 1181550SUSE bug 1181556cpe:/o:suse:suse-microos:5.0CVE-2020-28368SUSE Linux Enterprise Micro 5.0
Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.
ModerateCVE-2020-28368SUSE bug 1178591SUSE bug 1178658cpe:/o:suse:suse-microos:5.0CVE-2020-28374SUSE Linux Enterprise Micro 5.0
In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.
ImportantCVE-2020-28374SUSE bug 1178372SUSE bug 1178684SUSE bug 1180676cpe:/o:suse:suse-microos:5.0CVE-2020-28588SUSE Linux Enterprise Micro 5.0
An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifically, this issue has been introduced in v5.1-rc4 (commit 631b7abacd02b88f4b0795c08b54ad4fc3e7c7c0) and is still present in v5.10-rc4, so it’s likely that all versions in between are affected. An attacker can read /proc/pid/syscall to trigger this vulnerability, which leads to the kernel leaking memory contents.
LowCVE-2020-28588SUSE bug 1182806cpe:/o:suse:suse-microos:5.0CVE-2020-28915SUSE Linux Enterprise Micro 5.0
A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def.
ModerateCVE-2020-28915SUSE bug 1178886cpe:/o:suse:suse-microos:5.0CVE-2020-28916SUSE Linux Enterprise Micro 5.0
hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.
ModerateCVE-2020-28916SUSE bug 1178683SUSE bug 1179468cpe:/o:suse:suse-microos:5.0CVE-2020-28941SUSE Linux Enterprise Micro 5.0
An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once.
ModerateCVE-2020-28941SUSE bug 1178740cpe:/o:suse:suse-microos:5.0CVE-2020-28972SUSE Linux Enterprise Micro 5.0
In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.
ImportantCVE-2020-28972SUSE bug 1181550SUSE bug 1181557cpe:/o:suse:suse-microos:5.0CVE-2020-28974SUSE Linux Enterprise Micro 5.0
A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height.
ModerateCVE-2020-28974SUSE bug 1178589cpe:/o:suse:suse-microos:5.0CVE-2020-29129SUSE Linux Enterprise Micro 5.0
ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
LowCVE-2020-29129SUSE bug 1179466SUSE bug 1179467SUSE bug 1179477SUSE bug 1179484cpe:/o:suse:suse-microos:5.0CVE-2020-29130SUSE Linux Enterprise Micro 5.0
slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
ModerateCVE-2020-29130SUSE bug 1178658SUSE bug 1179467SUSE bug 1179477cpe:/o:suse:suse-microos:5.0CVE-2020-29361SUSE Linux Enterprise Micro 5.0
An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.
ImportantCVE-2020-29361SUSE bug 1180064cpe:/o:suse:suse-microos:5.0CVE-2020-29368SUSE Linux Enterprise Micro 5.0
An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.
ModerateCVE-2020-29368SUSE bug 1179428SUSE bug 1179660SUSE bug 1179664cpe:/o:suse:suse-microos:5.0CVE-2020-29369SUSE Linux Enterprise Micro 5.0
An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe.
ModerateCVE-2020-29369SUSE bug 1173504SUSE bug 1179432SUSE bug 1179646SUSE bug 1182109cpe:/o:suse:suse-microos:5.0CVE-2020-29370SUSE Linux Enterprise Micro 5.0
An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the required TID increment, aka CID-fd4d9c7d0c71.
ModerateCVE-2020-29370SUSE bug 1179435SUSE bug 1179648cpe:/o:suse:suse-microos:5.0CVE-2020-29371SUSE Linux Enterprise Micro 5.0
An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.
LowCVE-2020-29371SUSE bug 1179429cpe:/o:suse:suse-microos:5.0CVE-2020-29372SUSE Linux Enterprise Micro 5.0
An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP_MADVISE implementation, aka CID-bc0c4d1e176e.
LowCVE-2020-29372SUSE bug 1179433cpe:/o:suse:suse-microos:5.0CVE-2020-29373SUSE Linux Enterprise Micro 5.0
An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations, aka CID-ff002b30181d.
ImportantCVE-2020-29373SUSE bug 1179434SUSE bug 1179779cpe:/o:suse:suse-microos:5.0CVE-2020-29374SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.
LowCVE-2020-29374SUSE bug 1179428SUSE bug 1179660cpe:/o:suse:suse-microos:5.0CVE-2020-29443SUSE Linux Enterprise Micro 5.0
ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.
LowCVE-2020-29443SUSE bug 1181108cpe:/o:suse:suse-microos:5.0CVE-2020-29480SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest administrator can watch the root xenstored node, which will cause notifications for every created, modified, and deleted key. A guest administrator can also use the special watches, which will cause a notification every time a domain is created and destroyed. Data may include: number, type, and domids of other VMs; existence and domids of driver domains; numbers of virtual interfaces, block devices, vcpus; existence of virtual framebuffers and their backend style (e.g., existence of VNC service); Xen VM UUIDs for other domains; timing information about domain creation and device setup; and some hints at the backend provisioning of VMs and their devices. The watch events do not contain values stored in xenstore, only key names. A guest administrator can observe non-sensitive domain and device lifecycle events relating to other guests. This information allows some insight into overall system configuration (including the number and general nature of other guests), and configuration of other guests (including the number and general nature of other guests' devices). This information might be commercially interesting or might make other attacks easier. There is not believed to be exposure of sensitive data. Specifically, there is no exposure of VNC passwords, port numbers, pathnames in host and guest filesystems, cryptographic keys, or within-guest data.
LowCVE-2020-29480SUSE bug 1178658SUSE bug 1179496cpe:/o:suse:suse-microos:5.0CVE-2020-29481SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing granted access rights are not removed when a domain is being destroyed. This means that a new domain created with the same domid will inherit the access rights to Xenstore nodes from the previous domain(s) with the same domid. Because all Xenstore entries of a guest below /local/domain/<domid> are being deleted by Xen tools when a guest is destroyed, only Xenstore entries of other guests still running are affected. For example, a newly created guest domain might be able to read sensitive information that had belonged to a previously existing guest domain. Both Xenstore implementations (C and Ocaml) are vulnerable.
ModerateCVE-2020-29481SUSE bug 1176349SUSE bug 1178658SUSE bug 1179498cpe:/o:suse:suse-microos:5.0CVE-2020-29483SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this protocol, xenstored will drop the connection to that guest. Unfortunately, this is done by just removing the guest from xenstored's internal management, resulting in the same actions as if the guest had been destroyed, including sending an @releaseDomain event. @releaseDomain events do not say that the guest has been removed. All watchers of this event must look at the states of all guests to find the guest that has been removed. When an @releaseDomain is generated due to a domain xenstored protocol violation, because the guest is still running, the watchers will not react. Later, when the guest is actually destroyed, xenstored will no longer have it stored in its internal data base, so no further @releaseDomain event will be sent. This can lead to a zombie domain; memory mappings of that guest's memory will not be removed, due to the missing event. This zombie domain will be cleaned up only after another domain is destroyed, as that will trigger another @releaseDomain event. If the device model of the guest that violated the Xenstore protocol is running in a stub-domain, a use-after-free case could happen in xenstored, after having removed the guest from its internal data base, possibly resulting in a crash of xenstored. A malicious guest can block resources of the host for a period after its own death. Guests with a stub domain device model can eventually crash xenstored, resulting in a more serious denial of service (the prevention of any further domain management operations). Only the C variant of Xenstore is affected; the Ocaml variant is not affected. Only HVM guests with a stubdom device model can cause a serious DoS.
ModerateCVE-2020-29483SUSE bug 1178658SUSE bug 1179502cpe:/o:suse:suse-microos:5.0CVE-2020-29484SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watch will receive a Xenstore message containing the path of the modified Xenstore entry that triggered the watch, and the tag that was specified when registering the watch. Any communication with xenstored is done via Xenstore messages, consisting of a message header and the payload. The payload length is limited to 4096 bytes. Any request to xenstored resulting in a response with a payload longer than 4096 bytes will result in an error. When registering a watch, the payload length limit applies to the combined length of the watched path and the specified tag. Because watches for a specific path are also triggered for all nodes below that path, the payload of a watch event message can be longer than the payload needed to register the watch. A malicious guest that registers a watch using a very large tag (i.e., with a registration operation payload length close to the 4096 byte limit) can cause the generation of watch events with a payload length larger than 4096 bytes, by writing to Xenstore entries below the watched path. This will result in an error condition in xenstored. This error can result in a NULL pointer dereference, leading to a crash of xenstored. A malicious guest administrator can cause xenstored to crash, leading to a denial of service. Following a xenstored crash, domains may continue to run, but management operations will be impossible. Only C xenstored is affected, oxenstored is not affected.
ModerateCVE-2020-29484SUSE bug 1178658SUSE bug 1179501cpe:/o:suse:suse-microos:5.0CVE-2020-29534SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.9.3. io_uring takes a non-refcounted reference to the files_struct of the process that submitted a request, causing execve() to incorrectly optimize unshare_fd(), aka CID-0f2122045b94.
ModerateCVE-2020-29534SUSE bug 1179598SUSE bug 1180564cpe:/o:suse:suse-microos:5.0CVE-2020-29566SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily de-scheduled. The device model will signal Xen when it has completed its operation, via an event channel, so that the relevant vCPU is rescheduled. If the device model were to signal Xen without having actually completed the operation, the de-schedule / re-schedule cycle would repeat. If, in addition, Xen is resignalled very quickly, the re-schedule may occur before the de-schedule was fully complete, triggering a shortcut. This potentially repeating process uses ordinary recursive function calls, and thus could result in a stack overflow. A malicious or buggy stubdomain serving a HVM guest can cause Xen to crash, resulting in a Denial of Service (DoS) to the entire host. Only x86 systems are affected. Arm systems are not affected. Only x86 stubdomains serving HVM guests can exploit the vulnerability.
ModerateCVE-2020-29566SUSE bug 1178658SUSE bug 1179506cpe:/o:suse:suse-microos:5.0CVE-2020-29568SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.
ModerateCVE-2020-29568SUSE bug 1179508cpe:/o:suse:suse-microos:5.0CVE-2020-29569SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback.
ImportantCVE-2020-29569SUSE bug 1179509SUSE bug 1180008cpe:/o:suse:suse-microos:5.0CVE-2020-29570SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is reversed. The consumer assumes, seeing the former initialized, that the latter are also ready for use. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system.
ModerateCVE-2020-29570SUSE bug 1179514cpe:/o:suse:suse-microos:5.0CVE-2020-29571SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels depends on the CPU observing consistent state. While the producer side uses appropriately ordered writes, the consumer side isn't protected against re-ordered reads, and may hence end up de-referencing a NULL pointer. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system. Only Arm systems may be vulnerable. Whether a system is vulnerable depends on the specific CPU. x86 systems are not vulnerable.
ModerateCVE-2020-29571SUSE bug 1179516cpe:/o:suse:suse-microos:5.0CVE-2020-29651SUSE Linux Enterprise Micro 5.0
A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.
ModerateCVE-2020-29651SUSE bug 1179805cpe:/o:suse:suse-microos:5.0CVE-2020-29660SUSE Linux Enterprise Micro 5.0
A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24.
ImportantCVE-2020-29660SUSE bug 1179745SUSE bug 1179877cpe:/o:suse:suse-microos:5.0CVE-2020-29661SUSE Linux Enterprise Micro 5.0
A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
ImportantCVE-2020-29661SUSE bug 1179745SUSE bug 1179877SUSE bug 1214268cpe:/o:suse:suse-microos:5.0CVE-2020-35499SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw in Linux kernel versions prior to 5.11 may be seen if sco_sock_getsockopt function in net/bluetooth/sco.c do not have a sanity check for a socket connection, when using BT_SNDMTU/BT_RCVMTU for SCO sockets. This could allow a local attacker with a special user privilege to crash the system (DOS) or leak kernel internal information.
ModerateCVE-2020-35499SUSE bug 1180460cpe:/o:suse:suse-microos:5.0CVE-2020-35501SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem
ModerateCVE-2020-35501SUSE bug 1182435cpe:/o:suse:suse-microos:5.0CVE-2020-35503SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. This issue occurs in the megasas_command_cancelled() callback function while dropping a SCSI request. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
ModerateCVE-2020-35503SUSE bug 1180432cpe:/o:suse:suse-microos:5.0CVE-2020-35504SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
ModerateCVE-2020-35504SUSE bug 1180433cpe:/o:suse:suse-microos:5.0CVE-2020-35505SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
ModerateCVE-2020-35505SUSE bug 1180434cpe:/o:suse:suse-microos:5.0CVE-2020-35506SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
ModerateCVE-2020-35506SUSE bug 1180435cpe:/o:suse:suse-microos:5.0CVE-2020-35508SUSE Linux Enterprise Micro 5.0
A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.
ModerateCVE-2020-35508SUSE bug 1180529cpe:/o:suse:suse-microos:5.0CVE-2020-35512SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors
ModerateCVE-2020-35512SUSE bug 1187105SUSE bug 1189662SUSE bug 1205052cpe:/o:suse:suse-microos:5.0CVE-2020-35513SUSE Linux Enterprise Micro 5.0
A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with access to the NFS could use this flaw to starve the resources causing denial of service.
ModerateCVE-2020-35513SUSE bug 1181362cpe:/o:suse:suse-microos:5.0CVE-2020-35519SUSE Linux Enterprise Micro 5.0
An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
ImportantCVE-2020-35519SUSE bug 1183696SUSE bug 1184953SUSE bug 1211495cpe:/o:suse:suse-microos:5.0CVE-2020-35662SUSE Linux Enterprise Micro 5.0
In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.
ImportantCVE-2020-35662SUSE bug 1181550SUSE bug 1181565cpe:/o:suse:suse-microos:5.0CVE-2020-36158SUSE Linux Enterprise Micro 5.0
mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332.
ImportantCVE-2020-36158SUSE bug 1180559SUSE bug 1180562cpe:/o:suse:suse-microos:5.0CVE-2020-36310SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a set_memory_region_test infinite loop for certain nested page faults, aka CID-e72436bc3a52.
ModerateCVE-2020-36310SUSE bug 1184512cpe:/o:suse:suse-microos:5.0CVE-2020-36311SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of service (soft lockup) by triggering destruction of a large SEV VM (which requires unregistering many encrypted regions), aka CID-7be74942f184.
LowCVE-2020-36311SUSE bug 1184511cpe:/o:suse:suse-microos:5.0CVE-2020-36312SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.8.10. virt/kvm/kvm_main.c has a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure, aka CID-f65886606c2d.
LowCVE-2020-36312SUSE bug 1184509cpe:/o:suse:suse-microos:5.0CVE-2020-36313SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.7. The KVM subsystem allows out-of-range access to memslots after a deletion, aka CID-0774a964ef56. This affects arch/s390/kvm/kvm-s390.c, include/linux/kvm_host.h, and virt/kvm/kvm_main.c.
ImportantCVE-2020-36313SUSE bug 1184504cpe:/o:suse:suse-microos:5.0CVE-2020-36322SUSE Linux Enterprise Micro 5.0
An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. fuse_do_getattr() calls make_bad_inode() in inappropriate situations, causing a system crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as CVE-2021-28950.
ImportantCVE-2020-36322SUSE bug 1184211SUSE bug 1184952SUSE bug 1189302cpe:/o:suse:suse-microos:5.0CVE-2020-36385SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.
ImportantCVE-2020-36385SUSE bug 1187050SUSE bug 1187052SUSE bug 1189302SUSE bug 1196174SUSE bug 1196810SUSE bug 1196914SUSE bug 1200084SUSE bug 1201734cpe:/o:suse:suse-microos:5.0CVE-2020-36386SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf.
ModerateCVE-2020-36386SUSE bug 1187038SUSE bug 1192868cpe:/o:suse:suse-microos:5.0CVE-2020-36387SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding, aka CID-6d816e088c35.
ImportantCVE-2020-36387SUSE bug 1187053cpe:/o:suse:suse-microos:5.0CVE-2020-36694SUSE Linux Enterprise Micro 5.0
An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace. NOTE: cc00bca was reverted in 5.12.
ModerateCVE-2020-36694SUSE bug 1211596cpe:/o:suse:suse-microos:5.0CVE-2020-3702SUSE Linux Enterprise Micro 5.0
u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150
ImportantCVE-2020-3702SUSE bug 1191193SUSE bug 1191529cpe:/o:suse:suse-microos:5.0CVE-2020-4788SUSE Linux Enterprise Micro 5.0
IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.
ModerateCVE-2020-4788SUSE bug 1177666SUSE bug 1181158cpe:/o:suse:suse-microos:5.0CVE-2020-6750SUSE Linux Enterprise Micro 5.0
GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.
LowCVE-2020-6750SUSE bug 1160668cpe:/o:suse:suse-microos:5.0CVE-2020-6829SUSE Linux Enterprise Micro 5.0
When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
CriticalCVE-2020-6829SUSE bug 1174763SUSE bug 1175686cpe:/o:suse:suse-microos:5.0CVE-2020-7039SUSE Linux Enterprise Micro 5.0
tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.
ModerateCVE-2020-7039SUSE bug 1161066cpe:/o:suse:suse-microos:5.0CVE-2020-7216SUSE Linux Enterprise Micro 5.0
An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets without a message type option.
ModerateCVE-2020-7216SUSE bug 1160905cpe:/o:suse:suse-microos:5.0CVE-2020-7217SUSE Linux Enterprise Micro 5.0
An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.
ModerateCVE-2020-7217SUSE bug 1160906cpe:/o:suse:suse-microos:5.0CVE-2020-7595SUSE Linux Enterprise Micro 5.0
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
ModerateCVE-2020-7595SUSE bug 1161517SUSE bug 1191860cpe:/o:suse:suse-microos:5.0CVE-2020-7919SUSE Linux Enterprise Micro 5.0
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
ImportantCVE-2020-7919SUSE bug 1164288cpe:/o:suse:suse-microos:5.0CVE-2020-8013SUSE Linux Enterprise Micro 5.0
A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.
ModerateCVE-2020-8013SUSE bug 1163922cpe:/o:suse:suse-microos:5.0CVE-2020-8023SUSE Linux Enterprise Micro 5.0
A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SECURITY, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to escalate privileges from user ldap to root. This issue affects: SUSE Enterprise Storage 5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Debuginfo 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Debuginfo 11-SP4 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Point of Sale 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 11-SECURITY openldap2-client-openssl1 versions prior to 2.4.26-0.74.13.1. SUSE Linux Enterprise Server 11-SP4-LTSS openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 12-SP2-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP2-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP4 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.31.1. SUSE Linux Enterprise Server for SAP 12-SP2 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 12-SP3 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.31.1. SUSE OpenStack Cloud 7 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud 8 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud Crowbar 8 openldap2 versions prior to 2.4.41-18.71.2. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.12.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.3.1.
ImportantCVE-2020-8023SUSE bug 1172698SUSE bug 1190347cpe:/o:suse:suse-microos:5.0CVE-2020-8025SUSE Linux Enterprise Micro 5.0
A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.
ModerateCVE-2020-8025SUSE bug 1171883cpe:/o:suse:suse-microos:5.0CVE-2020-8027SUSE Linux Enterprise Micro 5.0
A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to overwrite arbitrary files and gain access to the openldap2 configuration This issue affects: SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.37.1. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.37.1. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.18.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.9.1.
ImportantCVE-2020-8027SUSE bug 1175568cpe:/o:suse:suse-microos:5.0CVE-2020-8130SUSE Linux Enterprise Micro 5.0
There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
ModerateCVE-2020-8130SUSE bug 1164804cpe:/o:suse:suse-microos:5.0CVE-2020-8169SUSE Linux Enterprise Micro 5.0
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
ModerateCVE-2020-8169SUSE bug 1173026SUSE bug 1186108cpe:/o:suse:suse-microos:5.0CVE-2020-8177SUSE Linux Enterprise Micro 5.0
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.
ImportantCVE-2020-8177SUSE bug 1173027SUSE bug 1186108cpe:/o:suse:suse-microos:5.0CVE-2020-8231SUSE Linux Enterprise Micro 5.0
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
LowCVE-2020-8231SUSE bug 1175109SUSE bug 1179399SUSE bug 1186108cpe:/o:suse:suse-microos:5.0CVE-2020-8284SUSE Linux Enterprise Micro 5.0
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
ModerateCVE-2020-8284SUSE bug 1179398SUSE bug 1179399SUSE bug 1186108cpe:/o:suse:suse-microos:5.0CVE-2020-8285SUSE Linux Enterprise Micro 5.0
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
ModerateCVE-2020-8285SUSE bug 1179399SUSE bug 1186108cpe:/o:suse:suse-microos:5.0CVE-2020-8286SUSE Linux Enterprise Micro 5.0
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
ModerateCVE-2020-8286SUSE bug 1179593SUSE bug 1186108cpe:/o:suse:suse-microos:5.0CVE-2020-8315SUSE Linux Enterprise Micro 5.0
In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.
ModerateCVE-2020-8315SUSE bug 1173935cpe:/o:suse:suse-microos:5.0CVE-2020-8428SUSE Linux Enterprise Micro 5.0
fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause a denial of service (OOPS) or possibly obtain sensitive information from kernel memory, aka CID-d0cb50185ae9. One attack vector may be an open system call for a UNIX domain socket, if the socket is being moved to a new parent directory and its old parent directory is being removed.
ModerateCVE-2020-8428SUSE bug 1162109cpe:/o:suse:suse-microos:5.0CVE-2020-8492SUSE Linux Enterprise Micro 5.0
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
ModerateCVE-2020-8492SUSE bug 1162367cpe:/o:suse:suse-microos:5.0CVE-2020-8608SUSE Linux Enterprise Micro 5.0
In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
ModerateCVE-2020-8608SUSE bug 1163018SUSE bug 1163019cpe:/o:suse:suse-microos:5.0CVE-2020-8647SUSE Linux Enterprise Micro 5.0
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c.
ModerateCVE-2020-8647SUSE bug 1162929SUSE bug 1164078cpe:/o:suse:suse-microos:5.0CVE-2020-8648SUSE Linux Enterprise Micro 5.0
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c.
ModerateCVE-2020-8648SUSE bug 1162928cpe:/o:suse:suse-microos:5.0CVE-2020-8649SUSE Linux Enterprise Micro 5.0
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c.
ModerateCVE-2020-8649SUSE bug 1162929SUSE bug 1162931cpe:/o:suse:suse-microos:5.0CVE-2020-8694SUSE Linux Enterprise Micro 5.0
Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
ModerateCVE-2020-8694SUSE bug 1170415SUSE bug 1170446SUSE bug 1178591SUSE bug 1178700SUSE bug 1179661cpe:/o:suse:suse-microos:5.0CVE-2020-8695SUSE Linux Enterprise Micro 5.0
Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
ModerateCVE-2020-8695SUSE bug 1170415SUSE bug 1170446SUSE bug 1178591cpe:/o:suse:suse-microos:5.0CVE-2020-8696SUSE Linux Enterprise Micro 5.0
Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
LowCVE-2020-8696SUSE bug 1173592cpe:/o:suse:suse-microos:5.0CVE-2020-8698SUSE Linux Enterprise Micro 5.0
Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
LowCVE-2020-8698SUSE bug 1173594cpe:/o:suse:suse-microos:5.0CVE-2020-8832SUSE Linux Enterprise Micro 5.0
The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.") was discovered to be incomplete, meaning that in versions of the kernel before 4.15.0-91.92, an attacker could use this vulnerability to expose sensitive information.
ModerateCVE-2020-8832SUSE bug 1165881cpe:/o:suse:suse-microos:5.0CVE-2020-8835SUSE Linux Enterprise Micro 5.0
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
ModerateCVE-2020-8835SUSE bug 1167722SUSE bug 1173755cpe:/o:suse:suse-microos:5.0CVE-2020-8992SUSE Linux Enterprise Micro 5.0
ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size.
LowCVE-2020-8992SUSE bug 1164069cpe:/o:suse:suse-microos:5.0CVE-2020-9327SUSE Linux Enterprise Micro 5.0
In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.
ModerateCVE-2020-9327SUSE bug 1164719cpe:/o:suse:suse-microos:5.0CVE-2020-9383SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2.
ModerateCVE-2020-9383SUSE bug 1165111cpe:/o:suse:suse-microos:5.0CVE-2020-9391SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID-dcde237319e6. This has been observed to cause heap corruption with the GNU C Library malloc implementation.
ModerateCVE-2020-9391SUSE bug 1165015cpe:/o:suse:suse-microos:5.0CVE-2021-0066SUSE Linux Enterprise Micro 5.0
Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via local access.
ImportantCVE-2021-0066SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0072SUSE Linux Enterprise Micro 5.0
Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable information disclosure via local access.
ImportantCVE-2021-0072SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0076SUSE Linux Enterprise Micro 5.0
Improper Validation of Specified Index, Position, or Offset in Input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable denial of service via local access.
ImportantCVE-2021-0076SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0089SUSE Linux Enterprise Micro 5.0
Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
ModerateCVE-2021-0089SUSE bug 1186433cpe:/o:suse:suse-microos:5.0CVE-2021-0127SUSE Linux Enterprise Micro 5.0
Insufficient control flow management in some Intel(R) Processors may allow an authenticated user to potentially enable a denial of service via local access.
ModerateCVE-2021-0127SUSE bug 1195779cpe:/o:suse:suse-microos:5.0CVE-2021-0129SUSE Linux Enterprise Micro 5.0
Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.
ModerateCVE-2021-0129SUSE bug 1186463cpe:/o:suse:suse-microos:5.0CVE-2021-0145SUSE Linux Enterprise Micro 5.0
Improper initialization of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
ModerateCVE-2021-0145SUSE bug 1195780cpe:/o:suse:suse-microos:5.0CVE-2021-0146SUSE Linux Enterprise Micro 5.0
Hardware allows activation of test or debug logic at runtime for some Intel(R) processors which may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
ImportantCVE-2021-0146SUSE bug 1192615SUSE bug 1193500SUSE bug 1200661SUSE bug 1200663SUSE bug 1205062cpe:/o:suse:suse-microos:5.0CVE-2021-0157SUSE Linux Enterprise Micro 5.0
Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
ImportantCVE-2021-0157SUSE bug 1192791cpe:/o:suse:suse-microos:5.0CVE-2021-0158SUSE Linux Enterprise Micro 5.0
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
ImportantCVE-2021-0158SUSE bug 1192793cpe:/o:suse:suse-microos:5.0CVE-2021-0161SUSE Linux Enterprise Micro 5.0
Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
ImportantCVE-2021-0161SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0164SUSE Linux Enterprise Micro 5.0
Improper access control in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via local access.
ImportantCVE-2021-0164SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0165SUSE Linux Enterprise Micro 5.0
Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
ImportantCVE-2021-0165SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0166SUSE Linux Enterprise Micro 5.0
Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
ImportantCVE-2021-0166SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0168SUSE Linux Enterprise Micro 5.0
Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
ImportantCVE-2021-0168SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0170SUSE Linux Enterprise Micro 5.0
Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an authenticated user to potentially enable information disclosure via local access.
ImportantCVE-2021-0170SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0172SUSE Linux Enterprise Micro 5.0
Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
ImportantCVE-2021-0172SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0173SUSE Linux Enterprise Micro 5.0
Improper Validation of Consistency within input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a unauthenticated user to potentially enable denial of service via adjacent access.
ImportantCVE-2021-0173SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0174SUSE Linux Enterprise Micro 5.0
Improper Use of Validation Framework in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a unauthenticated user to potentially enable denial of service via adjacent access.
ImportantCVE-2021-0174SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0175SUSE Linux Enterprise Micro 5.0
Improper Validation of Specified Index, Position, or Offset in Input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
ImportantCVE-2021-0175SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0176SUSE Linux Enterprise Micro 5.0
Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable denial of service via local access.
ImportantCVE-2021-0176SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0183SUSE Linux Enterprise Micro 5.0
Improper Validation of Specified Index, Position, or Offset in Input in software for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
ImportantCVE-2021-0183SUSE bug 1196333cpe:/o:suse:suse-microos:5.0CVE-2021-0326SUSE Linux Enterprise Micro 5.0
In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525
ImportantCVE-2021-0326SUSE bug 1181777cpe:/o:suse:suse-microos:5.0CVE-2021-0342SUSE Linux Enterprise Micro 5.0
In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. User interaction is not required for exploitation. Product: Android; Versions: Android kernel; Android ID: A-146554327.
ModerateCVE-2021-0342SUSE bug 1180812SUSE bug 1180859cpe:/o:suse:suse-microos:5.0CVE-2021-0512SUSE Linux Enterprise Micro 5.0
In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-173843328References: Upstream kernel
ImportantCVE-2021-0512SUSE bug 1187595SUSE bug 1187597cpe:/o:suse:suse-microos:5.0CVE-2021-0605SUSE Linux Enterprise Micro 5.0
In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-110373476
ImportantCVE-2021-0605SUSE bug 1187601SUSE bug 1187687SUSE bug 1188381cpe:/o:suse:suse-microos:5.0CVE-2021-0606SUSE Linux Enterprise Micro 5.0
In drm_syncobj_handle_to_fd of drm_syncobj.c, there is a possible use after free due to incorrect refcounting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168034487
ModerateCVE-2021-0606SUSE bug 1187602cpe:/o:suse:suse-microos:5.0CVE-2021-0707SUSE Linux Enterprise Micro 5.0
In dma_buf_release of dma-buf.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-155756045References: Upstream kernel
ImportantCVE-2021-0707SUSE bug 1198437SUSE bug 1199332cpe:/o:suse:suse-microos:5.0CVE-2021-0920SUSE Linux Enterprise Micro 5.0
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
ImportantCVE-2021-0920SUSE bug 1193731SUSE bug 1194463SUSE bug 1195939SUSE bug 1199255SUSE bug 1200084cpe:/o:suse:suse-microos:5.0CVE-2021-0924SUSE Linux Enterprise Micro 5.0
In xhci_vendor_get_ops of xhci.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194461020References: Upstream kernel
ImportantCVE-2021-0924SUSE bug 1193792cpe:/o:suse:suse-microos:5.0CVE-2021-0929SUSE Linux Enterprise Micro 5.0
In ion_dma_buf_end_cpu_access and related functions of ion.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-187527909References: Upstream kernel
ImportantCVE-2021-0929SUSE bug 1193794cpe:/o:suse:suse-microos:5.0CVE-2021-0938SUSE Linux Enterprise Micro 5.0
In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-171418586References: Upstream kernel
ModerateCVE-2021-0938SUSE bug 1192039cpe:/o:suse:suse-microos:5.0CVE-2021-0939SUSE Linux Enterprise Micro 5.0
In set_default_passthru_cfg of passthru.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186026549References: N/A
LowCVE-2021-0939SUSE bug 1192043cpe:/o:suse:suse-microos:5.0CVE-2021-0941SUSE Linux Enterprise Micro 5.0
In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References: Upstream kernel
ImportantCVE-2021-0941SUSE bug 1192045SUSE bug 1192048cpe:/o:suse:suse-microos:5.0CVE-2021-0961SUSE Linux Enterprise Micro 5.0
In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196046570References: Upstream kernel
ModerateCVE-2021-0961SUSE bug 1193790cpe:/o:suse:suse-microos:5.0CVE-2021-1043SUSE Linux Enterprise Micro 5.0
In TBD of TBD, there is a possible downgrade attack due to under utilized anti-rollback protections. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194697257References: N/A
LowCVE-2021-1043SUSE bug 1199357cpe:/o:suse:suse-microos:5.0CVE-2021-20177SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected.
ModerateCVE-2021-20177SUSE bug 1180765cpe:/o:suse:suse-microos:5.0CVE-2021-20181SUSE Linux Enterprise Micro 5.0
A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.
ImportantCVE-2021-20181SUSE bug 1182137cpe:/o:suse:suse-microos:5.0CVE-2021-20193SUSE Linux Enterprise Micro 5.0
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.
LowCVE-2021-20193SUSE bug 1181131cpe:/o:suse:suse-microos:5.0CVE-2021-20194SUSE Linux Enterprise Micro 5.0
There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation.
ModerateCVE-2021-20194SUSE bug 1181637SUSE bug 1182010SUSE bug 1182330cpe:/o:suse:suse-microos:5.0CVE-2021-20196SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
LowCVE-2021-20196SUSE bug 1181361cpe:/o:suse:suse-microos:5.0CVE-2021-20201SUSE Linux Enterprise Micro 5.0
A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection.
ModerateCVE-2021-20201SUSE bug 1181686cpe:/o:suse:suse-microos:5.0CVE-2021-20203SUSE Linux Enterprise Micro 5.0
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
LowCVE-2021-20203SUSE bug 1181639cpe:/o:suse:suse-microos:5.0CVE-2021-20221SUSE Linux Enterprise Micro 5.0
An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
ModerateCVE-2021-20221SUSE bug 1181933cpe:/o:suse:suse-microos:5.0CVE-2021-20226SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.
ImportantCVE-2021-20226SUSE bug 1180564SUSE bug 1181846cpe:/o:suse:suse-microos:5.0CVE-2021-20231SUSE Linux Enterprise Micro 5.0
A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.
ImportantCVE-2021-20231SUSE bug 1183457cpe:/o:suse:suse-microos:5.0CVE-2021-20232SUSE Linux Enterprise Micro 5.0
A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.
ImportantCVE-2021-20232SUSE bug 1183456cpe:/o:suse:suse-microos:5.0CVE-2021-20239SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to confidentiality.
ModerateCVE-2021-20239SUSE bug 1182010SUSE bug 1182330cpe:/o:suse:suse-microos:5.0CVE-2021-20255SUSE Linux Enterprise Micro 5.0
A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controller commands due to a DMA reentry issue. This flaw allows a guest user or process to consume CPU cycles or crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
LowCVE-2021-20255SUSE bug 1182651SUSE bug 1182654cpe:/o:suse:suse-microos:5.0CVE-2021-20257SUSE Linux Enterprise Micro 5.0
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
LowCVE-2021-20257SUSE bug 1182577SUSE bug 1182846cpe:/o:suse:suse-microos:5.0CVE-2021-20263SUSE Linux Enterprise Micro 5.0
A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.
LowCVE-2021-20263SUSE bug 1183373cpe:/o:suse:suse-microos:5.0CVE-2021-20265SUSE Linux Enterprise Micro 5.0
A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-20265SUSE bug 1183089SUSE bug 1214268cpe:/o:suse:suse-microos:5.0CVE-2021-20266SUSE Linux Enterprise Micro 5.0
A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.
LowCVE-2021-20266SUSE bug 1183632cpe:/o:suse:suse-microos:5.0CVE-2021-20268SUSE Linux Enterprise Micro 5.0
An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF script calls dev_map_init_map or sock_map_alloc. This flaw allows a local user to crash the system or possibly escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
ImportantCVE-2021-20268SUSE bug 1183077SUSE bug 1183095cpe:/o:suse:suse-microos:5.0CVE-2021-20269SUSE Linux Enterprise Micro 5.0
A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal information from a previous panic. The highest threat from this vulnerability is to confidentiality. This flaw affects kexec-tools shipped by Fedora versions prior to 2.0.21-8 and RHEL versions prior to 2.0.20-47.
ModerateCVE-2021-20269SUSE bug 1189468cpe:/o:suse:suse-microos:5.0CVE-2021-20271SUSE Linux Enterprise Micro 5.0
A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.
LowCVE-2021-20271SUSE bug 1183545cpe:/o:suse:suse-microos:5.0CVE-2021-20305SUSE Linux Enterprise Micro 5.0
A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.
ImportantCVE-2021-20305SUSE bug 1183835SUSE bug 1184401cpe:/o:suse:suse-microos:5.0CVE-2021-20322SUSE Linux Enterprise Micro 5.0
A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.
ImportantCVE-2021-20322SUSE bug 1191790SUSE bug 1191813SUSE bug 1193290cpe:/o:suse:suse-microos:5.0CVE-2021-21284SUSE Linux Enterprise Micro 5.0
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.
LowCVE-2021-21284SUSE bug 1181732cpe:/o:suse:suse-microos:5.0CVE-2021-21285SUSE Linux Enterprise Micro 5.0
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
ModerateCVE-2021-21285SUSE bug 1181730cpe:/o:suse:suse-microos:5.0CVE-2021-21334SUSE Linux Enterprise Micro 5.0
In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.
ModerateCVE-2021-21334SUSE bug 1183397cpe:/o:suse:suse-microos:5.0CVE-2021-21781SUSE Linux Enterprise Micro 5.0
An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222 4.19.177 5.4.99 5.10.17 5.11
LowCVE-2021-21781SUSE bug 1188445cpe:/o:suse:suse-microos:5.0CVE-2021-21996SUSE Linux Enterprise Micro 5.0
An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.
ModerateCVE-2021-21996SUSE bug 1190265SUSE bug 1210934cpe:/o:suse:suse-microos:5.0CVE-2021-22004SUSE Linux Enterprise Micro 5.0
An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software.
ModerateCVE-2021-22004SUSE bug 1196745cpe:/o:suse:suse-microos:5.0CVE-2021-22543SUSE Linux Enterprise Micro 5.0
An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation.
ImportantCVE-2021-22543SUSE bug 1186482SUSE bug 1186483SUSE bug 1190276SUSE bug 1197660cpe:/o:suse:suse-microos:5.0CVE-2021-22555SUSE Linux Enterprise Micro 5.0
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
ImportantCVE-2021-22555SUSE bug 1188116SUSE bug 1188117SUSE bug 1188411cpe:/o:suse:suse-microos:5.0CVE-2021-22570SUSE Linux Enterprise Micro 5.0
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
ModerateCVE-2021-22570SUSE bug 1195258cpe:/o:suse:suse-microos:5.0CVE-2021-22600SUSE Linux Enterprise Micro 5.0
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
ImportantCVE-2021-22600SUSE bug 1195184SUSE bug 1195307cpe:/o:suse:suse-microos:5.0CVE-2021-22876SUSE Linux Enterprise Micro 5.0
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.
ModerateCVE-2021-22876SUSE bug 1183933cpe:/o:suse:suse-microos:5.0CVE-2021-22890SUSE Linux Enterprise Micro 5.0
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.
LowCVE-2021-22890SUSE bug 1183934cpe:/o:suse:suse-microos:5.0CVE-2021-22898SUSE Linux Enterprise Micro 5.0
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
ModerateCVE-2021-22898SUSE bug 1186114SUSE bug 1192450cpe:/o:suse:suse-microos:5.0CVE-2021-22922SUSE Linux Enterprise Micro 5.0
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.
ModerateCVE-2021-22922SUSE bug 1188217SUSE bug 1192447cpe:/o:suse:suse-microos:5.0CVE-2021-22923SUSE Linux Enterprise Micro 5.0
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
ModerateCVE-2021-22923SUSE bug 1188218SUSE bug 1192447cpe:/o:suse:suse-microos:5.0CVE-2021-22924SUSE Linux Enterprise Micro 5.0
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.
ModerateCVE-2021-22924SUSE bug 1188219SUSE bug 1192447SUSE bug 1200196cpe:/o:suse:suse-microos:5.0CVE-2021-22925SUSE Linux Enterprise Micro 5.0
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.
ModerateCVE-2021-22925SUSE bug 1188220SUSE bug 1192447SUSE bug 1200196cpe:/o:suse:suse-microos:5.0CVE-2021-22926SUSE Linux Enterprise Micro 5.0
libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.
ImportantCVE-2021-22926SUSE bug 1188510SUSE bug 1192447SUSE bug 1192757cpe:/o:suse:suse-microos:5.0CVE-2021-22946SUSE Linux Enterprise Micro 5.0
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.
ModerateCVE-2021-22946SUSE bug 1190373SUSE bug 1194948cpe:/o:suse:suse-microos:5.0CVE-2021-22947SUSE Linux Enterprise Micro 5.0
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
ModerateCVE-2021-22947SUSE bug 1190374cpe:/o:suse:suse-microos:5.0CVE-2021-23134SUSE Linux Enterprise Micro 5.0
Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.
ImportantCVE-2021-23134SUSE bug 1186060SUSE bug 1186061cpe:/o:suse:suse-microos:5.0CVE-2021-23239SUSE Linux Enterprise Micro 5.0
The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.
LowCVE-2021-23239SUSE bug 1171722SUSE bug 1180684cpe:/o:suse:suse-microos:5.0CVE-2021-23240SUSE Linux Enterprise Micro 5.0
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.
ImportantCVE-2021-23240SUSE bug 1171722SUSE bug 1180685cpe:/o:suse:suse-microos:5.0CVE-2021-23336SUSE Linux Enterprise Micro 5.0
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
ModerateCVE-2021-23336SUSE bug 1182179SUSE bug 1182379SUSE bug 1182433cpe:/o:suse:suse-microos:5.0CVE-2021-23840SUSE Linux Enterprise Micro 5.0
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
ModerateCVE-2021-23840SUSE bug 1182333SUSE bug 1187743SUSE bug 1214334cpe:/o:suse:suse-microos:5.0CVE-2021-23841SUSE Linux Enterprise Micro 5.0
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
ModerateCVE-2021-23841SUSE bug 1182331SUSE bug 1187743SUSE bug 1214334cpe:/o:suse:suse-microos:5.0CVE-2021-23981SUSE Linux Enterprise Micro 5.0
A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.
ImportantCVE-2021-23981SUSE bug 1183942cpe:/o:suse:suse-microos:5.0CVE-2021-23982SUSE Linux Enterprise Micro 5.0
Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.
ImportantCVE-2021-23982SUSE bug 1183942cpe:/o:suse:suse-microos:5.0CVE-2021-23984SUSE Linux Enterprise Micro 5.0
A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.
ImportantCVE-2021-23984SUSE bug 1183942cpe:/o:suse:suse-microos:5.0CVE-2021-23987SUSE Linux Enterprise Micro 5.0
Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.
ImportantCVE-2021-23987SUSE bug 1183942cpe:/o:suse:suse-microos:5.0CVE-2021-24031SUSE Linux Enterprise Micro 5.0
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.
ModerateCVE-2021-24031SUSE bug 1183371cpe:/o:suse:suse-microos:5.0CVE-2021-24032SUSE Linux Enterprise Micro 5.0
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.
ModerateCVE-2021-24032SUSE bug 1183370SUSE bug 1183371cpe:/o:suse:suse-microos:5.0CVE-2021-25281SUSE Linux Enterprise Micro 5.0
An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
ImportantCVE-2021-25281SUSE bug 1181550SUSE bug 1181559cpe:/o:suse:suse-microos:5.0CVE-2021-25282SUSE Linux Enterprise Micro 5.0
An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.
ImportantCVE-2021-25282SUSE bug 1181550SUSE bug 1181560cpe:/o:suse:suse-microos:5.0CVE-2021-25283SUSE Linux Enterprise Micro 5.0
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
ImportantCVE-2021-25283SUSE bug 1181550SUSE bug 1181561cpe:/o:suse:suse-microos:5.0CVE-2021-25284SUSE Linux Enterprise Micro 5.0
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
ImportantCVE-2021-25284SUSE bug 1181550cpe:/o:suse:suse-microos:5.0CVE-2021-25315SUSE Linux Enterprise Micro 5.0
CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
CriticalCVE-2021-25315SUSE bug 1182382cpe:/o:suse:suse-microos:5.0CVE-2021-26318SUSE Linux Enterprise Micro 5.0
A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information.
ModerateCVE-2021-26318SUSE bug 1191653cpe:/o:suse:suse-microos:5.0CVE-2021-26401SUSE Linux Enterprise Micro 5.0
LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.
ModerateCVE-2021-26401SUSE bug 1191580SUSE bug 1196901SUSE bug 1209630cpe:/o:suse:suse-microos:5.0CVE-2021-26708SUSE Linux Enterprise Micro 5.0
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support.
ModerateCVE-2021-26708SUSE bug 1181806SUSE bug 1183298cpe:/o:suse:suse-microos:5.0CVE-2021-26930SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error. This affects drivers/block/xen-blkback/blkback.c.
ImportantCVE-2021-26930SUSE bug 1181843SUSE bug 1182294cpe:/o:suse:suse-microos:5.0CVE-2021-26931SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c.
ModerateCVE-2021-26931SUSE bug 1181753SUSE bug 1183022cpe:/o:suse:suse-microos:5.0CVE-2021-26932SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and drivers/xen/gntdev.c.
ModerateCVE-2021-26932SUSE bug 1181747cpe:/o:suse:suse-microos:5.0CVE-2021-26934SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this wasn't stated accordingly in its support status entry.
ImportantCVE-2021-26934SUSE bug 1181755SUSE bug 1185892cpe:/o:suse:suse-microos:5.0CVE-2021-27218SUSE Linux Enterprise Micro 5.0
An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.
ModerateCVE-2021-27218SUSE bug 1182328SUSE bug 1182362cpe:/o:suse:suse-microos:5.0CVE-2021-27219SUSE Linux Enterprise Micro 5.0
An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.
ModerateCVE-2021-27219SUSE bug 1182362SUSE bug 1194015cpe:/o:suse:suse-microos:5.0CVE-2021-27363SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.
ImportantCVE-2021-27363SUSE bug 1182716SUSE bug 1182717SUSE bug 1183120SUSE bug 1200084cpe:/o:suse:suse-microos:5.0CVE-2021-27364SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
ImportantCVE-2021-27364SUSE bug 1182715SUSE bug 1182716SUSE bug 1182717SUSE bug 1200084SUSE bug 1214268cpe:/o:suse:suse-microos:5.0CVE-2021-27365SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.
ModerateCVE-2021-27365SUSE bug 1182712SUSE bug 1182715SUSE bug 1183491SUSE bug 1200084SUSE bug 1214268cpe:/o:suse:suse-microos:5.0CVE-2021-27853SUSE Linux Enterprise Micro 5.0
Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.
ModerateCVE-2021-27853SUSE bug 1203840cpe:/o:suse:suse-microos:5.0CVE-2021-27854SUSE Linux Enterprise Micro 5.0
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using combinations of VLAN 0 headers, LLC/SNAP headers, and converting frames from Ethernet to Wifi and its reverse.
ModerateCVE-2021-27854SUSE bug 1203839cpe:/o:suse:suse-microos:5.0CVE-2021-27861SUSE Linux Enterprise Micro 5.0
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers)
ModerateCVE-2021-27861SUSE bug 1203838cpe:/o:suse:suse-microos:5.0CVE-2021-27862SUSE Linux Enterprise Micro 5.0
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers).
ModerateCVE-2021-27862SUSE bug 1182623SUSE bug 1203837cpe:/o:suse:suse-microos:5.0CVE-2021-28038SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931.
ModerateCVE-2021-28038SUSE bug 1183022SUSE bug 1183069cpe:/o:suse:suse-microos:5.0CVE-2021-28039SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom0 or driver domain via a large amount of I/O activity. The issue relates to misuse of guest physical addresses when a configuration has CONFIG_XEN_UNPOPULATED_ALLOC but not CONFIG_XEN_BALLOON_MEMORY_HOTPLUG.
ModerateCVE-2021-28039SUSE bug 1183035SUSE bug 1183071cpe:/o:suse:suse-microos:5.0CVE-2021-28041SUSE Linux Enterprise Micro 5.0
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
ImportantCVE-2021-28041SUSE bug 1183137cpe:/o:suse:suse-microos:5.0CVE-2021-28153SUSE Linux Enterprise Micro 5.0
An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
LowCVE-2021-28153SUSE bug 1183533cpe:/o:suse:suse-microos:5.0CVE-2021-28375SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85. This is a related issue to CVE-2019-2308.
ImportantCVE-2021-28375SUSE bug 1183596SUSE bug 1184955cpe:/o:suse:suse-microos:5.0CVE-2021-28660SUSE Linux Enterprise Micro 5.0
rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases, CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may have situations in which a drivers/staging issue is relevant to their own customer base.
ImportantCVE-2021-28660SUSE bug 1183593SUSE bug 1183658cpe:/o:suse:suse-microos:5.0CVE-2021-28687SUSE Linux Enterprise Micro 5.0
HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of them. When the "soft reset" feature was implemented, the libxl__domain_suspend_state structure didn't require any initialization or disposal. At some point later, an initialization function was introduced for the structure; but the "soft reset" path wasn't refactored to call the initialization function. When a guest nwo initiates a "soft reboot", uninitialized data structure leads to an assert() when later code finds the structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How this affects the system depends on the structure of the toolstack. For xl, this will have no security-relevant effect: every VM has its own independent monitoring process, which contains no state. The domain in question will hang in a crashed state, but can be destroyed by `xl destroy` just like any other non-cooperating domain. For daemon-based toolstacks linked against libxl, such as libvirt, this will crash the toolstack, losing the state of any in-progress operations (localized DoS), and preventing further administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If crashes "leak" resources, then repeated crashes could use up resources, also causing a system-wide DoS.
ModerateCVE-2021-28687SUSE bug 1183072cpe:/o:suse:suse-microos:5.0CVE-2021-28688SUSE Linux Enterprise Micro 5.0
The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable. XSA-365 was classified to affect versions back to at least 3.11.
ModerateCVE-2021-28688SUSE bug 1183646cpe:/o:suse:suse-microos:5.0CVE-2021-28690SUSE Linux Enterprise Micro 5.0
x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please see https://xenbits.xen.org/xsa/advisory-305.html for details. Mitigating TAA by disabling TSX (the default and preferred option) requires selecting a non-default setting in MSR_TSX_CTRL. This setting isn't restored after S3 suspend.
ModerateCVE-2021-28690SUSE bug 1186434cpe:/o:suse:suse-microos:5.0CVE-2021-28691SUSE Linux Enterprise Micro 5.0
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
ImportantCVE-2021-28691SUSE bug 1186430cpe:/o:suse:suse-microos:5.0CVE-2021-28692SUSE Linux Enterprise Micro 5.0
inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completion of such commands is not used. Instead, the issuing CPU spin-waits for the completion of the most recently issued command(s). Some of these waiting loops try to apply a timeout to fail overly-slow commands. The course of action upon a perceived timeout actually being detected is inappropriate: - on Intel hardware guests which did not originally cause the timeout may be marked as crashed, - on AMD hardware higher layer callers would not be notified of the issue, making them continue as if the IOMMU operation succeeded.
ModerateCVE-2021-28692SUSE bug 1186429cpe:/o:suse:suse-microos:5.0CVE-2021-28693SUSE Linux Enterprise Micro 5.0
xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed on Arm.
ModerateCVE-2021-28693SUSE bug 1186428cpe:/o:suse:suse-microos:5.0CVE-2021-28694SUSE Linux Enterprise Micro 5.0
IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696).
ImportantCVE-2021-28694SUSE bug 1189373SUSE bug 1189980cpe:/o:suse:suse-microos:5.0CVE-2021-28695SUSE Linux Enterprise Micro 5.0
IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696).
ImportantCVE-2021-28695SUSE bug 1189373SUSE bug 1189980cpe:/o:suse:suse-microos:5.0CVE-2021-28696SUSE Linux Enterprise Micro 5.0
IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696).
ImportantCVE-2021-28696SUSE bug 1189373SUSE bug 1189980cpe:/o:suse:suse-microos:5.0CVE-2021-28697SUSE Linux Enterprise Micro 5.0
grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes.
ImportantCVE-2021-28697SUSE bug 1189376cpe:/o:suse:suse-microos:5.0CVE-2021-28698SUSE Linux Enterprise Micro 5.0
long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to map grants offered by other domains. In the process of carrying out certain actions, Xen would iterate over all such entries, including ones which aren't in use anymore and some which may have been created but never used. If the number of entries for a given domain is large enough, this iterating of the entire table may tie up a CPU for too long, starving other domains or causing issues in the hypervisor itself. Note that a domain may map its own grants, i.e. there is no need for multiple domains to be involved here. A pair of "cooperating" guests may, however, cause the effects to be more severe.
ModerateCVE-2021-28698SUSE bug 1189378cpe:/o:suse:suse-microos:5.0CVE-2021-28699SUSE Linux Enterprise Micro 5.0
inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this mode, a guest has two tables. As a result, guests also need to be able to retrieve the addresses that the new status tracking table can be accessed through. For 32-bit guests on x86, translation of requests has to occur because the interface structure layouts commonly differ between 32- and 64-bit. The translation of the request to obtain the frame numbers of the grant status table involves translating the resulting array of frame numbers. Since the space used to carry out the translation is limited, the translation layer tells the core function the capacity of the array within translation space. Unfortunately the core function then only enforces array bounds to be below 8 times the specified value, and would write past the available space if enough frame numbers needed storing.
ModerateCVE-2021-28699SUSE bug 1189380SUSE bug 1194306cpe:/o:suse:suse-microos:5.0CVE-2021-28700SUSE Linux Enterprise Micro 5.0
xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the memory limit from them is not set. This allow a domain to allocate memory beyond what an administrator originally configured.
ModerateCVE-2021-28700SUSE bug 1189381cpe:/o:suse:suse-microos:5.0CVE-2021-28701SUSE Linux Enterprise Micro 5.0
Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.
ImportantCVE-2021-28701SUSE bug 1189632cpe:/o:suse:suse-microos:5.0CVE-2021-28702SUSE Linux Enterprise Micro 5.0
PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest, then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure, including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
ModerateCVE-2021-28702SUSE bug 1191363cpe:/o:suse:suse-microos:5.0CVE-2021-28703SUSE Linux Enterprise Micro 5.0
grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes. This bug was fortuitously fixed by code cleanup in Xen 4.14, and backported to security-supported Xen branches as a prerequisite of the fix for XSA-378.
ModerateCVE-2021-28703SUSE bug 1192555cpe:/o:suse:suse-microos:5.0CVE-2021-28704SUSE Linux Enterprise Micro 5.0
PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).
ModerateCVE-2021-28704SUSE bug 1192557cpe:/o:suse:suse-microos:5.0CVE-2021-28705SUSE Linux Enterprise Micro 5.0
issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error handling in certain PoD cases has been insufficient in that in particular partial success of some operations was not properly accounted for. There are two code paths affected - page removal (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix to both issues.)
ModerateCVE-2021-28705SUSE bug 1192559cpe:/o:suse:suse-microos:5.0CVE-2021-28706SUSE Linux Enterprise Micro 5.0
guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.
ModerateCVE-2021-28706SUSE bug 1192554cpe:/o:suse:suse-microos:5.0CVE-2021-28707SUSE Linux Enterprise Micro 5.0
PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).
ModerateCVE-2021-28707cpe:/o:suse:suse-microos:5.0CVE-2021-28708SUSE Linux Enterprise Micro 5.0
PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).
ModerateCVE-2021-28708cpe:/o:suse:suse-microos:5.0CVE-2021-28709SUSE Linux Enterprise Micro 5.0
issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error handling in certain PoD cases has been insufficient in that in particular partial success of some operations was not properly accounted for. There are two code paths affected - page removal (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix to both issues.)
ModerateCVE-2021-28709cpe:/o:suse:suse-microos:5.0CVE-2021-28710SUSE Linux Enterprise Micro 5.0
certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structures (page tables) may (and, on suitable hardware, by default will) be shared between CPUs, for second-level translation (EPT), and IOMMUs. These page tables are presently set up to always be 4 levels deep. However, an IOMMU may require the use of just 3 page table levels. In such a configuration the lop level table needs to be stripped before inserting the root table's address into the hardware pagetable base register. When sharing page tables, Xen erroneously skipped this stripping. Consequently, the guest is able to write to leaf page table entries.
ImportantCVE-2021-28710SUSE bug 1192888cpe:/o:suse:suse-microos:5.0CVE-2021-28711SUSE Linux Enterprise Micro 5.0
Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as "driver domains". Running PV backends in driver domains has one primary security advantage: if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. There are three affected backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch 3, CVE-2021-28713
ModerateCVE-2021-28711SUSE bug 1193440cpe:/o:suse:suse-microos:5.0CVE-2021-28712SUSE Linux Enterprise Micro 5.0
Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as "driver domains". Running PV backends in driver domains has one primary security advantage: if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. There are three affected backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch 3, CVE-2021-28713
ModerateCVE-2021-28712cpe:/o:suse:suse-microos:5.0CVE-2021-28713SUSE Linux Enterprise Micro 5.0
Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as "driver domains". Running PV backends in driver domains has one primary security advantage: if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. There are three affected backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch 3, CVE-2021-28713
ModerateCVE-2021-28713cpe:/o:suse:suse-microos:5.0CVE-2021-28714SUSE Linux Enterprise Micro 5.0
Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)
ModerateCVE-2021-28714SUSE bug 1193442cpe:/o:suse:suse-microos:5.0CVE-2021-28715SUSE Linux Enterprise Micro 5.0
Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)
ModerateCVE-2021-28715cpe:/o:suse:suse-microos:5.0CVE-2021-28950SUSE Linux Enterprise Micro 5.0
An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1.
ModerateCVE-2021-28950SUSE bug 1184194SUSE bug 1184211cpe:/o:suse:suse-microos:5.0CVE-2021-28951SUSE Linux Enterprise Micro 5.0
An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25.
ModerateCVE-2021-28951SUSE bug 1184195cpe:/o:suse:suse-microos:5.0CVE-2021-28952SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This has been fixed in 5.12-rc4.)
ImportantCVE-2021-28952SUSE bug 1184197SUSE bug 1184199cpe:/o:suse:suse-microos:5.0CVE-2021-28964SUSE Linux Enterprise Micro 5.0
A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc.
ModerateCVE-2021-28964SUSE bug 1184193cpe:/o:suse:suse-microos:5.0CVE-2021-28965SUSE Linux Enterprise Micro 5.0
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
ModerateCVE-2021-28965SUSE bug 1184644cpe:/o:suse:suse-microos:5.0CVE-2021-28971SUSE Linux Enterprise Micro 5.0
In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6.
ModerateCVE-2021-28971SUSE bug 1184196cpe:/o:suse:suse-microos:5.0CVE-2021-28972SUSE Linux Enterprise Micro 5.0
In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8.
ModerateCVE-2021-28972SUSE bug 1184198cpe:/o:suse:suse-microos:5.0CVE-2021-29154SUSE Linux Enterprise Micro 5.0
BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.
ModerateCVE-2021-29154SUSE bug 1184391SUSE bug 1184710SUSE bug 1186408cpe:/o:suse:suse-microos:5.0CVE-2021-29155SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer arithmetic operations, the pointer modification performed by the first operation is not correctly accounted for when restricting subsequent operations.
ModerateCVE-2021-29155SUSE bug 1184942cpe:/o:suse:suse-microos:5.0CVE-2021-29264SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driver allows attackers to cause a system crash because a negative fragment size is calculated in situations involving an rx queue overrun when jumbo packets are used and NAPI is enabled, aka CID-d8861bab48b6.
ModerateCVE-2021-29264SUSE bug 1184168cpe:/o:suse:suse-microos:5.0CVE-2021-29265SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70.
ModerateCVE-2021-29265SUSE bug 1184167cpe:/o:suse:suse-microos:5.0CVE-2021-29266SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_ctx has an invalid value upon re-opening a character device, aka CID-f6bbf0010ba0.
ModerateCVE-2021-29266SUSE bug 1184166cpe:/o:suse:suse-microos:5.0CVE-2021-29646SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does not properly validate certain data sizes, aka CID-0217ed2848e8.
ModerateCVE-2021-29646SUSE bug 1184191cpe:/o:suse:suse-microos:5.0CVE-2021-29647SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure, aka CID-50535249f624.
ModerateCVE-2021-29647SUSE bug 1184192cpe:/o:suse:suse-microos:5.0CVE-2021-29648SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_ids and resolved_sizes are intentionally uninitialized in the vmlinux BPF Type Format (BTF), which can cause a system crash upon an unexpected access attempt (in map_create in kernel/bpf/syscall.c or check_btf_info in kernel/bpf/verifier.c), aka CID-350a5c4dd245.
ModerateCVE-2021-29648SUSE bug 1184200cpe:/o:suse:suse-microos:5.0CVE-2021-29649SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.11.11. The user mode driver (UMD) has a copy_process() memory leak, related to a lack of cleanup steps in kernel/usermode_driver.c and kernel/bpf/preload/bpf_preload_kern.c, aka CID-f60a85cad677.
ModerateCVE-2021-29649SUSE bug 1184205cpe:/o:suse:suse-microos:5.0CVE-2021-29650SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.
ModerateCVE-2021-29650SUSE bug 1184208cpe:/o:suse:suse-microos:5.0CVE-2021-29657SUSE Linux Enterprise Micro 5.0
arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.
ImportantCVE-2021-29657SUSE bug 1188637cpe:/o:suse:suse-microos:5.0CVE-2021-30002SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b.
ModerateCVE-2021-30002SUSE bug 1184120cpe:/o:suse:suse-microos:5.0CVE-2021-30004SUSE Linux Enterprise Micro 5.0
In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
ModerateCVE-2021-30004SUSE bug 1184348cpe:/o:suse:suse-microos:5.0CVE-2021-30178SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dereference for certain accesses to the SynIC Hyper-V context, aka CID-919f4ebc5987.
ModerateCVE-2021-30178SUSE bug 1184499cpe:/o:suse:suse-microos:5.0CVE-2021-30465SUSE Linux Enterprise Micro 5.0
runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
ImportantCVE-2021-30465SUSE bug 1185405SUSE bug 1189161cpe:/o:suse:suse-microos:5.0CVE-2021-3144SUSE Linux Enterprise Micro 5.0
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
ImportantCVE-2021-3144SUSE bug 1181550SUSE bug 1181562cpe:/o:suse:suse-microos:5.0CVE-2021-31440SUSE Linux Enterprise Micro 5.0
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-13661.
ModerateCVE-2021-31440SUSE bug 1190126SUSE bug 1190127cpe:/o:suse:suse-microos:5.0CVE-2021-3148SUSE Linux Enterprise Micro 5.0
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
ImportantCVE-2021-3148SUSE bug 1181550SUSE bug 1181558cpe:/o:suse:suse-microos:5.0CVE-2021-31535SUSE Linux Enterprise Micro 5.0
LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session.
ImportantCVE-2021-31535SUSE bug 1182506SUSE bug 1191879SUSE bug 1205051cpe:/o:suse:suse-microos:5.0CVE-2021-3156SUSE Linux Enterprise Micro 5.0
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
ImportantCVE-2021-3156SUSE bug 1180684SUSE bug 1181090SUSE bug 1181506SUSE bug 1181657SUSE bug 1183936cpe:/o:suse:suse-microos:5.0CVE-2021-31607SUSE Linux Enterprise Micro 5.0
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).
ModerateCVE-2021-31607SUSE bug 1185281SUSE bug 1210934cpe:/o:suse:suse-microos:5.0CVE-2021-3177SUSE Linux Enterprise Micro 5.0
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
ModerateCVE-2021-3177SUSE bug 1181126cpe:/o:suse:suse-microos:5.0CVE-2021-31795SUSE Linux Enterprise Micro 5.0
The PowerVR GPU kernel driver in pvrsrvkm.ko through 2021-04-24 for the Linux kernel, as used on Alcatel 1S phones, allows attackers to overwrite heap memory via PhysmemNewRamBackedPMR.
ModerateCVE-2021-31795SUSE bug 1185354cpe:/o:suse:suse-microos:5.0CVE-2021-31799SUSE Linux Enterprise Micro 5.0
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
ImportantCVE-2021-31799SUSE bug 1190375SUSE bug 1196771cpe:/o:suse:suse-microos:5.0CVE-2021-31810SUSE Linux Enterprise Micro 5.0
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
ImportantCVE-2021-31810SUSE bug 1188161SUSE bug 1193383SUSE bug 1205053cpe:/o:suse:suse-microos:5.0CVE-2021-31829SUSE Linux Enterprise Micro 5.0
kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attacks, aka CID-801c6058d14a. The specific concern is not protecting the BPF stack area against speculative loads. Also, the BPF stack can contain uninitialized data that might represent sensitive information previously operated on by the kernel.
ModerateCVE-2021-31829SUSE bug 1188561cpe:/o:suse:suse-microos:5.0CVE-2021-3185SUSE Linux Enterprise Micro 5.0
A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.
ImportantCVE-2021-3185SUSE bug 1181255cpe:/o:suse:suse-microos:5.0CVE-2021-31916SUSE Linux Enterprise Micro 5.0
An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-31916SUSE bug 1192781cpe:/o:suse:suse-microos:5.0CVE-2021-3197SUSE Linux Enterprise Micro 5.0
An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
ImportantCVE-2021-3197SUSE bug 1181550SUSE bug 1181564cpe:/o:suse:suse-microos:5.0CVE-2021-32066SUSE Linux Enterprise Micro 5.0
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
ImportantCVE-2021-32066SUSE bug 1188160SUSE bug 1196771SUSE bug 1205053cpe:/o:suse:suse-microos:5.0CVE-2021-32078SUSE Linux Enterprise Micro 5.0
An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to element -2 of an array, aka CID-298a58e165e4.
LowCVE-2021-32078SUSE bug 1187489cpe:/o:suse:suse-microos:5.0CVE-2021-32399SUSE Linux Enterprise Micro 5.0
net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.
ImportantCVE-2021-32399SUSE bug 1184611SUSE bug 1185898SUSE bug 1185899SUSE bug 1196174SUSE bug 1200084SUSE bug 1201734cpe:/o:suse:suse-microos:5.0CVE-2021-32606SUSE Linux Enterprise Micro 5.0
In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-free. (This does not affect earlier versions that lack CAN ISOTP SF_BROADCAST support.)
ImportantCVE-2021-32606SUSE bug 1185953cpe:/o:suse:suse-microos:5.0CVE-2021-32760SUSE Linux Enterprise Micro 5.0
containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.
LowCVE-2021-32760SUSE bug 1188282cpe:/o:suse:suse-microos:5.0CVE-2021-33034SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
ImportantCVE-2021-33034SUSE bug 1186111SUSE bug 1186285cpe:/o:suse:suse-microos:5.0CVE-2021-3308SUSE Linux Enterprise Micro 5.0
An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system, not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices can mount a Denial of Service (DoS) attack affecting the pass through of PCI devices to other guests or the hardware domain. In the latter case, this would affect the entire host.
ModerateCVE-2021-3308SUSE bug 1181254cpe:/o:suse:suse-microos:5.0CVE-2021-33098SUSE Linux Enterprise Micro 5.0
Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow an authenticated user to potentially enable denial of service via local access.
ModerateCVE-2021-33098SUSE bug 1192877cpe:/o:suse:suse-microos:5.0CVE-2021-33120SUSE Linux Enterprise Micro 5.0
Out of bounds read under complex microarchitectural condition in memory subsystem for some Intel Atom(R) Processors may allow authenticated user to potentially enable information disclosure or cause denial of service via network access.
LowCVE-2021-33120SUSE bug 1195781cpe:/o:suse:suse-microos:5.0CVE-2021-33135SUSE Linux Enterprise Micro 5.0
Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access.
ModerateCVE-2021-33135SUSE bug 1199515cpe:/o:suse:suse-microos:5.0CVE-2021-33139SUSE Linux Enterprise Micro 5.0
Improper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.
ModerateCVE-2021-33139SUSE bug 1195786cpe:/o:suse:suse-microos:5.0CVE-2021-33155SUSE Linux Enterprise Micro 5.0
Improper input validation in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.
ModerateCVE-2021-33155SUSE bug 1195786cpe:/o:suse:suse-microos:5.0CVE-2021-33200SUSE Linux Enterprise Micro 5.0
kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
ImportantCVE-2021-33200SUSE bug 1186484SUSE bug 1186498cpe:/o:suse:suse-microos:5.0CVE-2021-3347SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
ImportantCVE-2021-3347SUSE bug 1181349SUSE bug 1181553SUSE bug 1190859cpe:/o:suse:suse-microos:5.0CVE-2021-3348SUSE Linux Enterprise Micro 5.0
nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.
ModerateCVE-2021-3348SUSE bug 1181504SUSE bug 1181645cpe:/o:suse:suse-microos:5.0CVE-2021-33560SUSE Linux Enterprise Micro 5.0
Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
ImportantCVE-2021-33560SUSE bug 1187212SUSE bug 1189854SUSE bug 1199664cpe:/o:suse:suse-microos:5.0CVE-2021-33574SUSE Linux Enterprise Micro 5.0
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.
ModerateCVE-2021-33574SUSE bug 1186489SUSE bug 1189426SUSE bug 1192788SUSE bug 1196766cpe:/o:suse:suse-microos:5.0CVE-2021-33624SUSE Linux Enterprise Micro 5.0
In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.
ModerateCVE-2021-33624SUSE bug 1187554cpe:/o:suse:suse-microos:5.0CVE-2021-33805SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-10906. Reason: This candidate is a duplicate of CVE-2018-10906. Notes: All CVE users should reference CVE-2018-10906 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
ModerateCVE-2021-33805SUSE bug 1186801cpe:/o:suse:suse-microos:5.0CVE-2021-33909SUSE Linux Enterprise Micro 5.0
fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.
ImportantCVE-2021-33909SUSE bug 1188062SUSE bug 1188063SUSE bug 1188257SUSE bug 1189302SUSE bug 1190859cpe:/o:suse:suse-microos:5.0CVE-2021-3392SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.
LowCVE-2021-3392SUSE bug 1189236cpe:/o:suse:suse-microos:5.0CVE-2021-33928SUSE Linux Enterprise Micro 5.0
Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.
LowCVE-2021-33928SUSE bug 1190148cpe:/o:suse:suse-microos:5.0CVE-2021-33929SUSE Linux Enterprise Micro 5.0
Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.
LowCVE-2021-33929SUSE bug 1190149cpe:/o:suse:suse-microos:5.0CVE-2021-33930SUSE Linux Enterprise Micro 5.0
Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.
LowCVE-2021-33930SUSE bug 1190150cpe:/o:suse:suse-microos:5.0CVE-2021-33938SUSE Linux Enterprise Micro 5.0
Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial of Service.
LowCVE-2021-33938SUSE bug 1190147cpe:/o:suse:suse-microos:5.0CVE-2021-3409SUSE Linux Enterprise Micro 5.0
The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.
ModerateCVE-2021-3409SUSE bug 1182282cpe:/o:suse:suse-microos:5.0CVE-2021-3411SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a padding of int3 in the linking state. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
ModerateCVE-2021-3411SUSE bug 1182498cpe:/o:suse:suse-microos:5.0CVE-2021-3416SUSE Linux Enterprise Micro 5.0
A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.
LowCVE-2021-3416SUSE bug 1182968SUSE bug 1186473cpe:/o:suse:suse-microos:5.0CVE-2021-3419SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.
ModerateCVE-2021-3419SUSE bug 1182968SUSE bug 1182975cpe:/o:suse:suse-microos:5.0CVE-2021-3421SUSE Linux Enterprise Micro 5.0
A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.
ModerateCVE-2021-3421SUSE bug 1183543cpe:/o:suse:suse-microos:5.0CVE-2021-3426SUSE Linux Enterprise Micro 5.0
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
ModerateCVE-2021-3426SUSE bug 1183374cpe:/o:suse:suse-microos:5.0CVE-2021-3428SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a system crash problem which can lead to an availability threat.
LowCVE-2021-3428SUSE bug 1173485SUSE bug 1183509cpe:/o:suse:suse-microos:5.0CVE-2021-34401SUSE Linux Enterprise Micro 5.0
NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER, where improper access control may lead to code execution, compromised integrity, or denial of service.
ImportantCVE-2021-34401SUSE bug 1194896cpe:/o:suse:suse-microos:5.0CVE-2021-34402SUSE Linux Enterprise Micro 5.0
NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write to a memory location that is outside the intended boundary of the buffer, which may lead to denial of service, Information disclosure, loss of Integrity, or possible escalation of privileges.
ModerateCVE-2021-34402SUSE bug 1194894cpe:/o:suse:suse-microos:5.0CVE-2021-34403SUSE Linux Enterprise Micro 5.0
NVIDIA Linux distributions contain a vulnerability in nvmap ioctl, which allows any user with a local account to exploit a use-after-free condition, leading to code privilege escalation, loss of confidentiality and integrity, or denial of service.
ImportantCVE-2021-34403SUSE bug 1194897cpe:/o:suse:suse-microos:5.0CVE-2021-34406SUSE Linux Enterprise Micro 5.0
NVIDIA Tegra kernel driver contains a vulnerability in NVHost, where a specific race condition can lead to a null pointer dereference, which may lead to a system reboot.
LowCVE-2021-34406SUSE bug 1194893cpe:/o:suse:suse-microos:5.0CVE-2021-3444SUSE Linux Enterprise Micro 5.0
The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101.
ModerateCVE-2021-3444SUSE bug 1184170SUSE bug 1184171cpe:/o:suse:suse-microos:5.0CVE-2021-3448SUSE Linux Enterprise Micro 5.0
A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.
LowCVE-2021-3448SUSE bug 1183709cpe:/o:suse:suse-microos:5.0CVE-2021-3449SUSE Linux Enterprise Micro 5.0
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
ImportantCVE-2021-3449SUSE bug 1183852cpe:/o:suse:suse-microos:5.0CVE-2021-34556SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.
ModerateCVE-2021-34556SUSE bug 1188983cpe:/o:suse:suse-microos:5.0CVE-2021-34693SUSE Linux Enterprise Micro 5.0
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.
ModerateCVE-2021-34693SUSE bug 1187452SUSE bug 1192868cpe:/o:suse:suse-microos:5.0CVE-2021-3483SUSE Linux Enterprise Micro 5.0
A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions before kernel 5.12-rc6 are affected
ModerateCVE-2021-3483SUSE bug 1184393cpe:/o:suse:suse-microos:5.0CVE-2021-34866SUSE Linux Enterprise Micro 5.0
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689.
ImportantCVE-2021-34866SUSE bug 1191645SUSE bug 1191646cpe:/o:suse:suse-microos:5.0CVE-2021-3489SUSE Linux Enterprise Micro 5.0
The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).
ImportantCVE-2021-3489SUSE bug 1185640SUSE bug 1185856cpe:/o:suse:suse-microos:5.0CVE-2021-3490SUSE Linux Enterprise Micro 5.0
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).
ImportantCVE-2021-3490SUSE bug 1185641SUSE bug 1185796cpe:/o:suse:suse-microos:5.0CVE-2021-3491SUSE Linux Enterprise Micro 5.0
The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1).
ImportantCVE-2021-3491SUSE bug 1185642SUSE bug 1187090cpe:/o:suse:suse-microos:5.0CVE-2021-3492SUSE Linux Enterprise Micro 5.0
Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562.
ModerateCVE-2021-3492SUSE bug 1184944cpe:/o:suse:suse-microos:5.0CVE-2021-3493SUSE Linux Enterprise Micro 5.0
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
ImportantCVE-2021-3493SUSE bug 1184900cpe:/o:suse:suse-microos:5.0CVE-2021-34981SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ImportantCVE-2021-34981SUSE bug 1191961SUSE bug 1192595SUSE bug 1196722SUSE bug 1212298cpe:/o:suse:suse-microos:5.0CVE-2021-3501SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.
ImportantCVE-2021-3501SUSE bug 1185380cpe:/o:suse:suse-microos:5.0CVE-2021-35039SUSE Linux Enterprise Micro 5.0
kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.
ImportantCVE-2021-35039SUSE bug 1188080SUSE bug 1188126cpe:/o:suse:suse-microos:5.0CVE-2021-3504SUSE Linux Enterprise Micro 5.0
A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-3504SUSE bug 1185013cpe:/o:suse:suse-microos:5.0CVE-2021-3506SUSE Linux Enterprise Micro 5.0
An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-3506SUSE bug 1184999cpe:/o:suse:suse-microos:5.0CVE-2021-3509SUSE Linux Enterprise Micro 5.0
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
ImportantCVE-2021-3509SUSE bug 1186021cpe:/o:suse:suse-microos:5.0CVE-2021-3516SUSE Linux Enterprise Micro 5.0
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.
ModerateCVE-2021-3516SUSE bug 1185409SUSE bug 1191860cpe:/o:suse:suse-microos:5.0CVE-2021-3517SUSE Linux Enterprise Micro 5.0
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
ImportantCVE-2021-3517SUSE bug 1185410SUSE bug 1191860SUSE bug 1194438SUSE bug 1196383cpe:/o:suse:suse-microos:5.0CVE-2021-3518SUSE Linux Enterprise Micro 5.0
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.
ModerateCVE-2021-3518SUSE bug 1185408SUSE bug 1191860cpe:/o:suse:suse-microos:5.0CVE-2021-3520SUSE Linux Enterprise Micro 5.0
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
ImportantCVE-2021-3520SUSE bug 1185438cpe:/o:suse:suse-microos:5.0CVE-2021-3524SUSE Linux Enterprise Micro 5.0
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
ModerateCVE-2021-3524SUSE bug 1185619cpe:/o:suse:suse-microos:5.0CVE-2021-3527SUSE Linux Enterprise Micro 5.0
A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
LowCVE-2021-3527SUSE bug 1186012cpe:/o:suse:suse-microos:5.0CVE-2021-3531SUSE Linux Enterprise Micro 5.0
A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to the system is of availability.
ImportantCVE-2021-3531SUSE bug 1186020cpe:/o:suse:suse-microos:5.0CVE-2021-3537SUSE Linux Enterprise Micro 5.0
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.
ImportantCVE-2021-3537SUSE bug 1185698cpe:/o:suse:suse-microos:5.0CVE-2021-3541SUSE Linux Enterprise Micro 5.0
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
ModerateCVE-2021-3541SUSE bug 1186015cpe:/o:suse:suse-microos:5.0CVE-2021-3542SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42739. Reason: This candidate is a reservation duplicate of CVE-2021-42739. Notes: All CVE users should reference CVE-2021-42739 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
ImportantCVE-2021-3542SUSE bug 1184673SUSE bug 1186063cpe:/o:suse:suse-microos:5.0CVE-2021-3543SUSE Linux Enterprise Micro 5.0
A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs forces closures on the enclave file descriptor. A local user of a host machine could use this flaw to crash the system or escalate their privileges on the system.
ImportantCVE-2021-3543SUSE bug 1185091cpe:/o:suse:suse-microos:5.0CVE-2021-3544SUSE Linux Enterprise Micro 5.0
Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime.
ModerateCVE-2021-3544SUSE bug 1186010cpe:/o:suse:suse-microos:5.0CVE-2021-3545SUSE Linux Enterprise Micro 5.0
An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memory from the host.
ModerateCVE-2021-3545SUSE bug 1185990cpe:/o:suse:suse-microos:5.0CVE-2021-3546SUSE Linux Enterprise Micro 5.0
An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw occurs while processing the 'VIRTIO_GPU_CMD_GET_CAPSET' command from the guest. It could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service condition, or potential code execution with the privileges of the QEMU process.
ModerateCVE-2021-3546SUSE bug 1185981cpe:/o:suse:suse-microos:5.0CVE-2021-35477SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value.
ModerateCVE-2021-35477SUSE bug 1188985cpe:/o:suse:suse-microos:5.0CVE-2021-3556SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: Assigned but a duplicate for CVE-2021-3559.
ModerateCVE-2021-3556SUSE bug 1191542cpe:/o:suse:suse-microos:5.0CVE-2021-3559SUSE Linux Enterprise Micro 5.0
A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts with a PCI device and driver that supports mediated devices (e.g., GRID driver). This flaw could be used by an unprivileged client with a read-only connection to crash the libvirt daemon by executing the 'nodedev-list' virsh command. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-3559SUSE bug 1191542cpe:/o:suse:suse-microos:5.0CVE-2021-3560SUSE Linux Enterprise Micro 5.0
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
ImportantCVE-2021-3560SUSE bug 1186497cpe:/o:suse:suse-microos:5.0CVE-2021-3573SUSE Linux Enterprise Micro 5.0
A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.
ImportantCVE-2021-3573SUSE bug 1186666SUSE bug 1187054SUSE bug 1188172cpe:/o:suse:suse-microos:5.0CVE-2021-3580SUSE Linux Enterprise Micro 5.0
A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.
ImportantCVE-2021-3580SUSE bug 1187060SUSE bug 1187892cpe:/o:suse:suse-microos:5.0CVE-2021-3582SUSE Linux Enterprise Micro 5.0
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability.
LowCVE-2021-3582SUSE bug 1187499cpe:/o:suse:suse-microos:5.0CVE-2021-3588SUSE Linux Enterprise Micro 5.0
The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.
LowCVE-2021-3588SUSE bug 1187165cpe:/o:suse:suse-microos:5.0CVE-2021-3592SUSE Linux Enterprise Micro 5.0
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
LowCVE-2021-3592SUSE bug 1187364SUSE bug 1187369cpe:/o:suse:suse-microos:5.0CVE-2021-3593SUSE Linux Enterprise Micro 5.0
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
LowCVE-2021-3593SUSE bug 1187365cpe:/o:suse:suse-microos:5.0CVE-2021-3594SUSE Linux Enterprise Micro 5.0
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
LowCVE-2021-3594SUSE bug 1187367cpe:/o:suse:suse-microos:5.0CVE-2021-35942SUSE Linux Enterprise Micro 5.0
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.
ModerateCVE-2021-35942SUSE bug 1187911SUSE bug 1192788cpe:/o:suse:suse-microos:5.0CVE-2021-3595SUSE Linux Enterprise Micro 5.0
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
LowCVE-2021-3595SUSE bug 1187366SUSE bug 1187376cpe:/o:suse:suse-microos:5.0CVE-2021-3601SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. OpenSSL does not class this issue as a security vulnerability. The trusted CA store should not contain anything that the user does not trust to issue other certificates. Notes: https://github.com/openssl/openssl/issues/5236#issuecomment-1196460611
LowCVE-2021-3601SUSE bug 1189259cpe:/o:suse:suse-microos:5.0CVE-2021-3607SUSE Linux Enterprise Micro 5.0
An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest due to improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
LowCVE-2021-3607SUSE bug 1187539cpe:/o:suse:suse-microos:5.0CVE-2021-3608SUSE Linux Enterprise Micro 5.0
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest threat from this vulnerability is to system availability.
LowCVE-2021-3608SUSE bug 1187538cpe:/o:suse:suse-microos:5.0CVE-2021-3609SUSE Linux Enterprise Micro 5.0
.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.
ModerateCVE-2021-3609SUSE bug 1187215SUSE bug 1188323SUSE bug 1188720SUSE bug 1190276SUSE bug 1196810cpe:/o:suse:suse-microos:5.0CVE-2021-3611SUSE Linux Enterprise Micro 5.0
A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.
ModerateCVE-2021-3611SUSE bug 1187529SUSE bug 1193914cpe:/o:suse:suse-microos:5.0CVE-2021-3612SUSE Linux Enterprise Micro 5.0
An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
LowCVE-2021-3612SUSE bug 1187585cpe:/o:suse:suse-microos:5.0CVE-2021-3622SUSE Linux Enterprise Micro 5.0
A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cause hivex to recursively call the _get_children() function, leading to a stack overflow. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-3622SUSE bug 1189060cpe:/o:suse:suse-microos:5.0CVE-2021-36222SUSE Linux Enterprise Micro 5.0
ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.
ImportantCVE-2021-36222SUSE bug 1188571cpe:/o:suse:suse-microos:5.0CVE-2021-3631SUSE Linux Enterprise Micro 5.0
A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.
ModerateCVE-2021-3631SUSE bug 1187871cpe:/o:suse:suse-microos:5.0CVE-2021-3634SUSE Linux Enterprise Micro 5.0
A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating "secret_hash" of different size than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used again during second key re-exchange.
LowCVE-2021-3634SUSE bug 1189608SUSE bug 1194948cpe:/o:suse:suse-microos:5.0CVE-2021-3635SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with root (CAP_SYS_ADMIN) access is able to panic the system when issuing netfilter netflow commands.
ModerateCVE-2021-3635SUSE bug 1189169cpe:/o:suse:suse-microos:5.0CVE-2021-3640SUSE Linux Enterprise Micro 5.0
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.
ImportantCVE-2021-3640SUSE bug 1188172SUSE bug 1188613SUSE bug 1191530SUSE bug 1196810SUSE bug 1196914cpe:/o:suse:suse-microos:5.0CVE-2021-3653SUSE Linux Enterprise Micro 5.0
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7.
ImportantCVE-2021-3653SUSE bug 1189399SUSE bug 1189420SUSE bug 1196914cpe:/o:suse:suse-microos:5.0CVE-2021-3655SUSE Linux Enterprise Micro 5.0
A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.
LowCVE-2021-3655SUSE bug 1188563cpe:/o:suse:suse-microos:5.0CVE-2021-3656SUSE Linux Enterprise Micro 5.0
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.
ImportantCVE-2021-3656SUSE bug 1189400SUSE bug 1189418cpe:/o:suse:suse-microos:5.0CVE-2021-3659SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-3659SUSE bug 1188876cpe:/o:suse:suse-microos:5.0CVE-2021-3667SUSE Linux Enterprise Micro 5.0
An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-3667SUSE bug 1188843cpe:/o:suse:suse-microos:5.0CVE-2021-3669SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.
ModerateCVE-2021-3669SUSE bug 1188986cpe:/o:suse:suse-microos:5.0CVE-2021-36770SUSE Linux Enterprise Micro 5.0
Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.
ImportantCVE-2021-36770SUSE bug 1188467cpe:/o:suse:suse-microos:5.0CVE-2021-3679SUSE Linux Enterprise Micro 5.0
A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
ModerateCVE-2021-3679SUSE bug 1189057cpe:/o:suse:suse-microos:5.0CVE-2021-3682SUSE Linux Enterprise Micro 5.0
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.
ModerateCVE-2021-3682SUSE bug 1189145cpe:/o:suse:suse-microos:5.0CVE-2021-3711SUSE Linux Enterprise Micro 5.0
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).
CriticalCVE-2021-3711SUSE bug 1189520SUSE bug 1190129SUSE bug 1192100SUSE bug 1205663cpe:/o:suse:suse-microos:5.0CVE-2021-3712SUSE Linux Enterprise Micro 5.0
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).
ModerateCVE-2021-3712SUSE bug 1189521SUSE bug 1190129SUSE bug 1191640SUSE bug 1192100SUSE bug 1192787SUSE bug 1194948cpe:/o:suse:suse-microos:5.0CVE-2021-3713SUSE Linux Enterprise Micro 5.0
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
ImportantCVE-2021-3713SUSE bug 1189702cpe:/o:suse:suse-microos:5.0CVE-2021-3715SUSE Linux Enterprise Micro 5.0
A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters, leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
ImportantCVE-2021-3715SUSE bug 1190349SUSE bug 1190350SUSE bug 1196722cpe:/o:suse:suse-microos:5.0CVE-2021-37159SUSE Linux Enterprise Micro 5.0
hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
ModerateCVE-2021-37159SUSE bug 1188601cpe:/o:suse:suse-microos:5.0CVE-2021-3732SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be accessible.
LowCVE-2021-3732SUSE bug 1189706cpe:/o:suse:suse-microos:5.0CVE-2021-3733SUSE Linux Enterprise Micro 5.0
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
LowCVE-2021-3733SUSE bug 1189287cpe:/o:suse:suse-microos:5.0CVE-2021-3735SUSE Linux Enterprise Micro 5.0
A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-3735SUSE bug 1189886cpe:/o:suse:suse-microos:5.0CVE-2021-3736SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated devices. This flaw could allow a local attacker to leak internal kernel information.
LowCVE-2021-3736SUSE bug 1192345cpe:/o:suse:suse-microos:5.0CVE-2021-3737SUSE Linux Enterprise Micro 5.0
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-3737SUSE bug 1189241cpe:/o:suse:suse-microos:5.0CVE-2021-3739SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bug requires ‘CAP_SYS_ADMIN’. This flaw allows a local attacker to crash the system or leak kernel internal information. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-3739SUSE bug 1189832cpe:/o:suse:suse-microos:5.0CVE-2021-3743SUSE Linux Enterprise Micro 5.0
An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-3743SUSE bug 1189883cpe:/o:suse:suse-microos:5.0CVE-2021-3744SUSE Linux Enterprise Micro 5.0
A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.
ModerateCVE-2021-3744SUSE bug 1189884SUSE bug 1190534cpe:/o:suse:suse-microos:5.0CVE-2021-3748SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.
ModerateCVE-2021-3748SUSE bug 1189938cpe:/o:suse:suse-microos:5.0CVE-2021-3752SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
ImportantCVE-2021-3752SUSE bug 1190023SUSE bug 1190432cpe:/o:suse:suse-microos:5.0CVE-2021-3753SUSE Linux Enterprise Micro 5.0
A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidentiality.
LowCVE-2021-3753SUSE bug 1190025cpe:/o:suse:suse-microos:5.0CVE-2021-37576SUSE Linux Enterprise Micro 5.0
arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e.
ImportantCVE-2021-37576SUSE bug 1188838SUSE bug 1188842SUSE bug 1190276cpe:/o:suse:suse-microos:5.0CVE-2021-3759SUSE Linux Enterprise Micro 5.0
A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-3759SUSE bug 1190115cpe:/o:suse:suse-microos:5.0CVE-2021-3760SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability.
ModerateCVE-2021-3760SUSE bug 1190067cpe:/o:suse:suse-microos:5.0CVE-2021-37600SUSE Linux Enterprise Micro 5.0
** DISPUTED ** An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.
ModerateCVE-2021-37600SUSE bug 1188921cpe:/o:suse:suse-microos:5.0CVE-2021-3764SUSE Linux Enterprise Micro 5.0
A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.
ModerateCVE-2021-3764SUSE bug 1190534SUSE bug 1194518cpe:/o:suse:suse-microos:5.0CVE-2021-3772SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.
ModerateCVE-2021-3772SUSE bug 1190351cpe:/o:suse:suse-microos:5.0CVE-2021-37750SUSE Linux Enterprise Micro 5.0
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.
ModerateCVE-2021-37750SUSE bug 1189929cpe:/o:suse:suse-microos:5.0CVE-2021-3778SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Heap-based Buffer Overflow
ModerateCVE-2021-3778SUSE bug 1190533cpe:/o:suse:suse-microos:5.0CVE-2021-3796SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Use After Free
ModerateCVE-2021-3796SUSE bug 1190570cpe:/o:suse:suse-microos:5.0CVE-2021-3800SUSE Linux Enterprise Micro 5.0
A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.
ModerateCVE-2021-3800SUSE bug 1191489cpe:/o:suse:suse-microos:5.0CVE-2021-38160SUSE Linux Enterprise Micro 5.0
** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior.
ModerateCVE-2021-38160SUSE bug 1190117SUSE bug 1190118SUSE bug 1196914cpe:/o:suse:suse-microos:5.0CVE-2021-38166SUSE Linux Enterprise Micro 5.0
In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.
ModerateCVE-2021-38166SUSE bug 1189233cpe:/o:suse:suse-microos:5.0CVE-2021-38185SUSE Linux Enterprise Micro 5.0
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.
ImportantCVE-2021-38185SUSE bug 1189206SUSE bug 1189486SUSE bug 1192364SUSE bug 1193391SUSE bug 1200733cpe:/o:suse:suse-microos:5.0CVE-2021-38198SUSE Linux Enterprise Micro 5.0
arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault.
ImportantCVE-2021-38198SUSE bug 1189262SUSE bug 1189278SUSE bug 1196914cpe:/o:suse:suse-microos:5.0CVE-2021-38199SUSE Linux Enterprise Micro 5.0
fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection.
ModerateCVE-2021-38199SUSE bug 1189265cpe:/o:suse:suse-microos:5.0CVE-2021-38200SUSE Linux Enterprise Micro 5.0
arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service (perf_instruction_pointer NULL pointer dereference and OOPS) via a "perf record" command.
ModerateCVE-2021-38200SUSE bug 1189276cpe:/o:suse:suse-microos:5.0CVE-2021-38201SUSE Linux Enterprise Micro 5.0
net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
ImportantCVE-2021-38201SUSE bug 1189288cpe:/o:suse:suse-microos:5.0CVE-2021-38202SUSE Linux Enterprise Micro 5.0
fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd.
ImportantCVE-2021-38202SUSE bug 1189289cpe:/o:suse:suse-microos:5.0CVE-2021-38203SUSE Linux Enterprise Micro 5.0
btrfs in the Linux kernel before 5.13.4 allows attackers to cause a denial of service (deadlock) via processes that trigger allocation of new system chunks during times when there is a shortage of free space in the system space_info.
ModerateCVE-2021-38203SUSE bug 1189290cpe:/o:suse:suse-microos:5.0CVE-2021-38204SUSE Linux Enterprise Micro 5.0
drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations.
ModerateCVE-2021-38204SUSE bug 1189291cpe:/o:suse:suse-microos:5.0CVE-2021-38205SUSE Linux Enterprise Micro 5.0
drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before 5.13.3 makes it easier for attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM pointer).
LowCVE-2021-38205SUSE bug 1189292cpe:/o:suse:suse-microos:5.0CVE-2021-38206SUSE Linux Enterprise Micro 5.0
The mac80211 subsystem in the Linux kernel before 5.12.13, when a device supporting only 5 GHz is used, allows attackers to cause a denial of service (NULL pointer dereference in the radiotap parser) by injecting a frame with 802.11a rates.
ModerateCVE-2021-38206SUSE bug 1189296cpe:/o:suse:suse-microos:5.0CVE-2021-38207SUSE Linux Enterprise Micro 5.0
drivers/net/ethernet/xilinx/ll_temac_main.c in the Linux kernel before 5.12.13 allows remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about ten minutes.
ModerateCVE-2021-38207SUSE bug 1189298cpe:/o:suse:suse-microos:5.0CVE-2021-38209SUSE Linux Enterprise Micro 5.0
net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls.
LowCVE-2021-38209SUSE bug 1189393cpe:/o:suse:suse-microos:5.0CVE-2021-38300SUSE Linux Enterprise Micro 5.0
arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context. This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture.
ImportantCVE-2021-38300SUSE bug 1190427cpe:/o:suse:suse-microos:5.0CVE-2021-38604SUSE Linux Enterprise Micro 5.0
In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.
ModerateCVE-2021-38604SUSE bug 1189426cpe:/o:suse:suse-microos:5.0CVE-2021-3864SUSE Linux Enterprise Micro 5.0
A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges.
ImportantCVE-2021-3864SUSE bug 1191281SUSE bug 1192449SUSE bug 1205059cpe:/o:suse:suse-microos:5.0CVE-2021-3872SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Heap-based Buffer Overflow
ImportantCVE-2021-3872SUSE bug 1191893cpe:/o:suse:suse-microos:5.0CVE-2021-3892SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-18198. Reason: This candidate is a reservation duplicate of CVE-2019-18198. Notes: All CVE users should reference CVE-2019-18198 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
ModerateCVE-2021-3892SUSE bug 1192261cpe:/o:suse:suse-microos:5.0CVE-2021-3896SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-43389. Reason: This candidate is a reservation duplicate of CVE-2021-43389. Notes: All CVE users should reference CVE-2021-43389 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
ModerateCVE-2021-3896SUSE bug 1191958cpe:/o:suse:suse-microos:5.0CVE-2021-3927SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Heap-based Buffer Overflow
ModerateCVE-2021-3927SUSE bug 1192481cpe:/o:suse:suse-microos:5.0CVE-2021-3928SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Use of Uninitialized Variable
ModerateCVE-2021-3928SUSE bug 1192478cpe:/o:suse:suse-microos:5.0CVE-2021-3930SUSE Linux Enterprise Micro 5.0
An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
LowCVE-2021-3930SUSE bug 1192525SUSE bug 1192526cpe:/o:suse:suse-microos:5.0CVE-2021-3947SUSE Linux Enterprise Micro 5.0
A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.
ModerateCVE-2021-3947SUSE bug 1192706cpe:/o:suse:suse-microos:5.0CVE-2021-39537SUSE Linux Enterprise Micro 5.0
An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.
ModerateCVE-2021-39537SUSE bug 1190793SUSE bug 1196626cpe:/o:suse:suse-microos:5.0CVE-2021-39636SUSE Linux Enterprise Micro 5.0
In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information due to uninitialized data. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-120612905References: Upstream kernel
ModerateCVE-2021-39636SUSE bug 1193812cpe:/o:suse:suse-microos:5.0CVE-2021-39648SUSE Linux Enterprise Micro 5.0
In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-160822094References: Upstream kernel
ModerateCVE-2021-39648SUSE bug 1193861cpe:/o:suse:suse-microos:5.0CVE-2021-39656SUSE Linux Enterprise Micro 5.0
In __configfs_open_file of file.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174049066References: Upstream kernel
ModerateCVE-2021-39656SUSE bug 1193862cpe:/o:suse:suse-microos:5.0CVE-2021-39657SUSE Linux Enterprise Micro 5.0
In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194696049References: Upstream kernel
LowCVE-2021-39657SUSE bug 1193864cpe:/o:suse:suse-microos:5.0CVE-2021-3968SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Heap-based Buffer Overflow
ImportantCVE-2021-3968SUSE bug 1192902SUSE bug 1208308SUSE bug 1208649SUSE bug 1208651cpe:/o:suse:suse-microos:5.0CVE-2021-39685SUSE Linux Enterprise Micro 5.0
In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel
ImportantCVE-2021-39685SUSE bug 1193802SUSE bug 1194459cpe:/o:suse:suse-microos:5.0CVE-2021-39686SUSE Linux Enterprise Micro 5.0
In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-200688826References: Upstream kernel
ModerateCVE-2021-39686SUSE bug 1196954cpe:/o:suse:suse-microos:5.0CVE-2021-39698SUSE Linux Enterprise Micro 5.0
In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-185125206References: Upstream kernel
ImportantCVE-2021-39698SUSE bug 1196956SUSE bug 1196959SUSE bug 1209225cpe:/o:suse:suse-microos:5.0CVE-2021-39714SUSE Linux Enterprise Micro 5.0
In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205573273References: Upstream kernel
ImportantCVE-2021-39714SUSE bug 1197214SUSE bug 1197218cpe:/o:suse:suse-microos:5.0CVE-2021-39715SUSE Linux Enterprise Micro 5.0
In __show_regs of process.c, there is a possible leak of kernel memory and addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-178379135References: Upstream kernel
ModerateCVE-2021-39715SUSE bug 1197210cpe:/o:suse:suse-microos:5.0CVE-2021-39725SUSE Linux Enterprise Micro 5.0
In gasket_free_coherent_memory_all of gasket_page_table.c, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-151454974References: N/A
ModerateCVE-2021-39725SUSE bug 1197206cpe:/o:suse:suse-microos:5.0CVE-2021-3973SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Heap-based Buffer Overflow
CriticalCVE-2021-3973SUSE bug 1192903SUSE bug 1208308SUSE bug 1208649SUSE bug 1208651cpe:/o:suse:suse-microos:5.0CVE-2021-39735SUSE Linux Enterprise Micro 5.0
In gasket_alloc_coherent_memory of gasket_page_table.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-151455484References: N/A
ModerateCVE-2021-39735SUSE bug 1197205cpe:/o:suse:suse-microos:5.0CVE-2021-3975SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.
ModerateCVE-2021-3975SUSE bug 1192876cpe:/o:suse:suse-microos:5.0CVE-2021-39792SUSE Linux Enterprise Micro 5.0
In usb_gadget_giveback_request of core.c, there is a possible use after free out of bounds read due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-161010552References: Upstream kernel
LowCVE-2021-39792SUSE bug 1197203cpe:/o:suse:suse-microos:5.0CVE-2021-39800SUSE Linux Enterprise Micro 5.0
In ion_ioctl of ion-ioctl.c, there is a possible way to leak kernel head data due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-208277166References: Upstream kernel
LowCVE-2021-39800SUSE bug 1198444cpe:/o:suse:suse-microos:5.0CVE-2021-39801SUSE Linux Enterprise Micro 5.0
In ion_ioctl of ion-ioctl.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-209791720References: Upstream kernel
ImportantCVE-2021-39801SUSE bug 1198443cpe:/o:suse:suse-microos:5.0CVE-2021-39802SUSE Linux Enterprise Micro 5.0
In change_pte_range of mprotect.c , there is a possible way to make a shared mmap writable due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-213339151References: Upstream kernel
ImportantCVE-2021-39802SUSE bug 1198445cpe:/o:suse:suse-microos:5.0CVE-2021-3981SUSE Linux Enterprise Micro 5.0
A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg. This flaw affects grub2 2.06 and previous versions. This issue has been fixed in grub upstream but no version with the fix is currently released.
LowCVE-2021-3981SUSE bug 1189644SUSE bug 1198244cpe:/o:suse:suse-microos:5.0CVE-2021-3984SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Heap-based Buffer Overflow
ModerateCVE-2021-3984SUSE bug 1193298cpe:/o:suse:suse-microos:5.0CVE-2021-3995SUSE Linux Enterprise Micro 5.0
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.
ModerateCVE-2021-3995SUSE bug 1194976cpe:/o:suse:suse-microos:5.0CVE-2021-3996SUSE Linux Enterprise Micro 5.0
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.
ModerateCVE-2021-3996SUSE bug 1194976cpe:/o:suse:suse-microos:5.0CVE-2021-3997SUSE Linux Enterprise Micro 5.0
A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.
ModerateCVE-2021-3997SUSE bug 1194178cpe:/o:suse:suse-microos:5.0CVE-2021-3998SUSE Linux Enterprise Micro 5.0
A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.
ModerateCVE-2021-3998SUSE bug 1194620cpe:/o:suse:suse-microos:5.0CVE-2021-3999SUSE Linux Enterprise Micro 5.0
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.
ImportantCVE-2021-3999SUSE bug 1194640SUSE bug 1196024SUSE bug 1196389SUSE bug 1199869SUSE bug 1200203cpe:/o:suse:suse-microos:5.0CVE-2021-4001SUSE Linux Enterprise Micro 5.0
A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2.
ImportantCVE-2021-4001SUSE bug 1192990SUSE bug 1192991cpe:/o:suse:suse-microos:5.0CVE-2021-4002SUSE Linux Enterprise Micro 5.0
A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data.
ModerateCVE-2021-4002SUSE bug 1192946SUSE bug 1192973cpe:/o:suse:suse-microos:5.0CVE-2021-4019SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Heap-based Buffer Overflow
ModerateCVE-2021-4019SUSE bug 1193294cpe:/o:suse:suse-microos:5.0CVE-2021-4023SUSE Linux Enterprise Micro 5.0
A flaw was found in the io-workqueue implementation in the Linux kernel versions prior to 5.15-rc1. The kernel can panic when an improper cancellation operation triggers the submission of new io-uring operations during a shortage of free space. This flaw allows a local user with permissions to execute io-uring requests to possibly crash the system.
ModerateCVE-2021-4023SUSE bug 1193107cpe:/o:suse:suse-microos:5.0CVE-2021-4024SUSE Linux Enterprise Micro 5.0
A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.
ModerateCVE-2021-4024SUSE bug 1193166cpe:/o:suse:suse-microos:5.0CVE-2021-4028SUSE Linux Enterprise Micro 5.0
A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free. Given the ability to execute code, a local attacker could leverage this use-after-free to crash the system or possibly escalate privileges on the system.
ImportantCVE-2021-4028SUSE bug 1193167SUSE bug 1193529cpe:/o:suse:suse-microos:5.0CVE-2021-4032SUSE Linux Enterprise Micro 5.0
A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected. In this flaw the KVM subsystem may crash the kernel due to mishandling of memory errors that happens during VCPU construction, which allows an attacker with special user privilege to cause a denial of service. This flaw affects kernel versions prior to 5.15 rc7.
ModerateCVE-2021-4032SUSE bug 1193187cpe:/o:suse:suse-microos:5.0CVE-2021-4034SUSE Linux Enterprise Micro 5.0
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
ImportantCVE-2021-4034SUSE bug 1194568SUSE bug 1195125SUSE bug 1195136SUSE bug 1195246SUSE bug 1195265SUSE bug 1195278SUSE bug 1195528SUSE bug 1195541SUSE bug 1196165SUSE bug 1196388cpe:/o:suse:suse-microos:5.0CVE-2021-4044SUSE Linux Enterprise Micro 5.0
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses. This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur where a certificate does not include the Subject Alternative Name extension but where a Certificate Authority has enforced name constraints. This issue can occur even with valid chains. By combining the two issues an attacker could induce incorrect, application dependent behaviour. Fixed in OpenSSL 3.0.1 (Affected 3.0.0).
ImportantCVE-2021-4044SUSE bug 1193740cpe:/o:suse:suse-microos:5.0CVE-2021-40490SUSE Linux Enterprise Micro 5.0
A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.
ModerateCVE-2021-40490SUSE bug 1190159SUSE bug 1192775cpe:/o:suse:suse-microos:5.0CVE-2021-4083SUSE Linux Enterprise Micro 5.0
A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4.
ImportantCVE-2021-4083SUSE bug 1193727SUSE bug 1194460SUSE bug 1196722cpe:/o:suse:suse-microos:5.0CVE-2021-4090SUSE Linux Enterprise Micro 5.0
An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat.
ModerateCVE-2021-4090SUSE bug 1193663cpe:/o:suse:suse-microos:5.0CVE-2021-4093SUSE Linux Enterprise Micro 5.0
A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape scenario.
ImportantCVE-2021-4093SUSE bug 1193716cpe:/o:suse:suse-microos:5.0CVE-2021-4095SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVM_XEN_HVM_SET_ATTR ioctl. This flaw affects Linux kernel versions prior to 5.17-rc1.
ModerateCVE-2021-4095SUSE bug 1193769cpe:/o:suse:suse-microos:5.0CVE-2021-41073SUSE Linux Enterprise Micro 5.0
loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.
ImportantCVE-2021-41073SUSE bug 1190664cpe:/o:suse:suse-microos:5.0CVE-2021-41089SUSE Linux Enterprise Micro 5.0
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.
ModerateCVE-2021-41089SUSE bug 1191015SUSE bug 1191355cpe:/o:suse:suse-microos:5.0CVE-2021-41091SUSE Linux Enterprise Micro 5.0
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.
ModerateCVE-2021-41091SUSE bug 1191355SUSE bug 1191434cpe:/o:suse:suse-microos:5.0CVE-2021-41092SUSE Linux Enterprise Micro 5.0
Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.
ModerateCVE-2021-41092SUSE bug 1191334SUSE bug 1191355cpe:/o:suse:suse-microos:5.0CVE-2021-41103SUSE Linux Enterprise Micro 5.0
containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories.
ModerateCVE-2021-41103SUSE bug 1191121SUSE bug 1191355cpe:/o:suse:suse-microos:5.0CVE-2021-4115SUSE Linux Enterprise Micro 5.0
There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned
LowCVE-2021-4115SUSE bug 1195542cpe:/o:suse:suse-microos:5.0CVE-2021-41190SUSE Linux Enterprise Micro 5.0
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.
ModerateCVE-2021-41190SUSE bug 1193273cpe:/o:suse:suse-microos:5.0CVE-2021-4122SUSE Linux Enterprise Micro 5.0
It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.
ModerateCVE-2021-4122SUSE bug 1194469cpe:/o:suse:suse-microos:5.0CVE-2021-4135SUSE Linux Enterprise Micro 5.0
A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data.
ModerateCVE-2021-4135SUSE bug 1193927cpe:/o:suse:suse-microos:5.0CVE-2021-4136SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Heap-based Buffer Overflow
ImportantCVE-2021-4136SUSE bug 1193905SUSE bug 1208308SUSE bug 1208649SUSE bug 1208651cpe:/o:suse:suse-microos:5.0CVE-2021-4145SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node.
ModerateCVE-2021-4145SUSE bug 1193995cpe:/o:suse:suse-microos:5.0CVE-2021-4147SUSE Linux Enterprise Micro 5.0
A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock or crash, resulting in a denial of service condition.
ImportantCVE-2021-4147SUSE bug 1194041SUSE bug 1194313cpe:/o:suse:suse-microos:5.0CVE-2021-4148SUSE Linux Enterprise Micro 5.0
A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem. A missing sanity check may allow a local attacker with user privilege to cause a denial of service (DOS) problem.
ModerateCVE-2021-4148SUSE bug 1193983cpe:/o:suse:suse-microos:5.0CVE-2021-4149SUSE Linux Enterprise Micro 5.0
A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem.
ModerateCVE-2021-4149SUSE bug 1194001cpe:/o:suse:suse-microos:5.0CVE-2021-4150SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the add_partition in block/partitions/core.c in the Linux kernel. A local attacker with user privileges could cause a denial of service on the system. The issue results from the lack of code cleanup when device_add call fails when adding a partition to the disk.
ModerateCVE-2021-4150SUSE bug 1193994cpe:/o:suse:suse-microos:5.0CVE-2021-4154SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.
ImportantCVE-2021-4154SUSE bug 1193842SUSE bug 1194461cpe:/o:suse:suse-microos:5.0CVE-2021-4158SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
ModerateCVE-2021-4158SUSE bug 1194063cpe:/o:suse:suse-microos:5.0CVE-2021-4160SUSE Linux Enterprise Micro 5.0
There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb).
ModerateCVE-2021-4160SUSE bug 1195379cpe:/o:suse:suse-microos:5.0CVE-2021-41617SUSE Linux Enterprise Micro 5.0
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
ModerateCVE-2021-41617SUSE bug 1190975SUSE bug 1193497SUSE bug 1196721SUSE bug 1200782SUSE bug 1205056SUSE bug 1212247SUSE bug 1212281cpe:/o:suse:suse-microos:5.0CVE-2021-4173SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Use After Free
ModerateCVE-2021-4173SUSE bug 1194108cpe:/o:suse:suse-microos:5.0CVE-2021-41816SUSE Linux Enterprise Micro 5.0
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.
CriticalCVE-2021-41816SUSE bug 1193080cpe:/o:suse:suse-microos:5.0CVE-2021-41817SUSE Linux Enterprise Micro 5.0
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
ModerateCVE-2021-41817SUSE bug 1193035cpe:/o:suse:suse-microos:5.0CVE-2021-41864SUSE Linux Enterprise Micro 5.0
prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.
ImportantCVE-2021-41864SUSE bug 1191317SUSE bug 1191318cpe:/o:suse:suse-microos:5.0CVE-2021-4187SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Use After Free
ModerateCVE-2021-4187SUSE bug 1194301cpe:/o:suse:suse-microos:5.0CVE-2021-4193SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Out-of-bounds Read
LowCVE-2021-4193SUSE bug 1194216cpe:/o:suse:suse-microos:5.0CVE-2021-4197SUSE Linux Enterprise Micro 5.0
An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system.
ModerateCVE-2021-4197SUSE bug 1194302cpe:/o:suse:suse-microos:5.0CVE-2021-42008SUSE Linux Enterprise Micro 5.0
The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.
ImportantCVE-2021-42008SUSE bug 1191315SUSE bug 1191660SUSE bug 1196722SUSE bug 1196810SUSE bug 1196914cpe:/o:suse:suse-microos:5.0CVE-2021-4202SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem while the device is getting removed, leading to a privilege escalation problem.
ModerateCVE-2021-4202SUSE bug 1194529SUSE bug 1194533cpe:/o:suse:suse-microos:5.0CVE-2021-4204SUSE Linux Enterprise Micro 5.0
An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a special privilege to crash the system or leak internal information.
ModerateCVE-2021-4204SUSE bug 1194111cpe:/o:suse:suse-microos:5.0CVE-2021-4206SUSE Linux Enterprise Micro 5.0
A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.
ImportantCVE-2021-4206SUSE bug 1198035SUSE bug 1211582cpe:/o:suse:suse-microos:5.0CVE-2021-4207SUSE Linux Enterprise Micro 5.0
A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.
ImportantCVE-2021-4207SUSE bug 1198037cpe:/o:suse:suse-microos:5.0CVE-2021-4209SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
ModerateCVE-2021-4209SUSE bug 1196167cpe:/o:suse:suse-microos:5.0CVE-2021-4218SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This flaw allows a local attacker with local access to cause a denial of service while the system reboots. The issue is specific to CentOS/RHEL.
ModerateCVE-2021-4218SUSE bug 1195374cpe:/o:suse:suse-microos:5.0CVE-2021-42252SUSE Linux Enterprise Micro 5.0
An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.
ImportantCVE-2021-42252SUSE bug 1190479SUSE bug 1192444cpe:/o:suse:suse-microos:5.0CVE-2021-42327SUSE Linux Enterprise Micro 5.0
dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer.
ImportantCVE-2021-42327SUSE bug 1191949cpe:/o:suse:suse-microos:5.0CVE-2021-42739SUSE Linux Enterprise Micro 5.0
A heap-based buffer overflow flaw was found in the Linux kernel FireDTV media card driver, where the user calls the CA_SEND_MSG ioctl. This flaw allows a local user of the host machine to crash the system or escalate privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
ImportantCVE-2021-42739SUSE bug 1184673SUSE bug 1192036SUSE bug 1196722SUSE bug 1196914cpe:/o:suse:suse-microos:5.0CVE-2021-42771SUSE Linux Enterprise Micro 5.0
Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
ImportantCVE-2021-42771SUSE bug 1185768cpe:/o:suse:suse-microos:5.0CVE-2021-43056SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the host, when the host is running on Power8, due to an arch/powerpc/kvm/book3s_hv_rmhandlers.S implementation bug in the handling of the SRR1 register values.
ModerateCVE-2021-43056SUSE bug 1192107cpe:/o:suse:suse-microos:5.0CVE-2021-43057SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and escalate privileges, aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective credentials of another task.
ImportantCVE-2021-43057SUSE bug 1192260cpe:/o:suse:suse-microos:5.0CVE-2021-43085SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
LowCVE-2021-43085SUSE bug 1197505cpe:/o:suse:suse-microos:5.0CVE-2021-43267SUSE Linux Enterprise Micro 5.0
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.
CriticalCVE-2021-43267SUSE bug 1192341SUSE bug 1195254cpe:/o:suse:suse-microos:5.0CVE-2021-43389SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c.
ModerateCVE-2021-43389SUSE bug 1191958cpe:/o:suse:suse-microos:5.0CVE-2021-43519SUSE Linux Enterprise Micro 5.0
Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.
LowCVE-2021-43519SUSE bug 1192613cpe:/o:suse:suse-microos:5.0CVE-2021-43527SUSE Linux Enterprise Micro 5.0
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
ImportantCVE-2021-43527SUSE bug 1193170SUSE bug 1193331SUSE bug 1193378SUSE bug 1194288SUSE bug 1199301cpe:/o:suse:suse-microos:5.0CVE-2021-43565SUSE Linux Enterprise Micro 5.0
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
ImportantCVE-2021-43565SUSE bug 1193930cpe:/o:suse:suse-microos:5.0CVE-2021-43618SUSE Linux Enterprise Micro 5.0
GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.
ModerateCVE-2021-43618SUSE bug 1192717cpe:/o:suse:suse-microos:5.0CVE-2021-43784SUSE Linux Enterprise Micro 5.0
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.
ModerateCVE-2021-43784SUSE bug 1193436cpe:/o:suse:suse-microos:5.0CVE-2021-43816SUSE Linux Enterprise Micro 5.0
containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.
ImportantCVE-2021-43816SUSE bug 1194359cpe:/o:suse:suse-microos:5.0CVE-2021-43975SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value.
ModerateCVE-2021-43975SUSE bug 1192845cpe:/o:suse:suse-microos:5.0CVE-2021-43976SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).
ModerateCVE-2021-43976SUSE bug 1192847cpe:/o:suse:suse-microos:5.0CVE-2021-44568SUSE Linux Enterprise Micro 5.0
Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at src/solver.c (line 1940 & line 1995), which could cause a remote Denial of Service.
LowCVE-2021-44568cpe:/o:suse:suse-microos:5.0CVE-2021-44569SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
LowCVE-2021-44569SUSE bug 1196288cpe:/o:suse:suse-microos:5.0CVE-2021-44570SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
LowCVE-2021-44570SUSE bug 1196288cpe:/o:suse:suse-microos:5.0CVE-2021-44571SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
LowCVE-2021-44571SUSE bug 1196288cpe:/o:suse:suse-microos:5.0CVE-2021-44573SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
LowCVE-2021-44573SUSE bug 1196288cpe:/o:suse:suse-microos:5.0CVE-2021-44574SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
LowCVE-2021-44574SUSE bug 1196288cpe:/o:suse:suse-microos:5.0CVE-2021-44575SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
LowCVE-2021-44575SUSE bug 1196288cpe:/o:suse:suse-microos:5.0CVE-2021-44576SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
LowCVE-2021-44576SUSE bug 1196288cpe:/o:suse:suse-microos:5.0CVE-2021-44577SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
LowCVE-2021-44577SUSE bug 1196288cpe:/o:suse:suse-microos:5.0CVE-2021-44647SUSE Linux Enterprise Micro 5.0
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
ModerateCVE-2021-44647SUSE bug 1194575cpe:/o:suse:suse-microos:5.0CVE-2021-44733SUSE Linux Enterprise Micro 5.0
A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.
ModerateCVE-2021-44733SUSE bug 1193767cpe:/o:suse:suse-microos:5.0CVE-2021-44879SUSE Linux Enterprise Micro 5.0
In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.
ModerateCVE-2021-44879SUSE bug 1195987cpe:/o:suse:suse-microos:5.0CVE-2021-44964SUSE Linux Enterprise Micro 5.0
Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file.
ImportantCVE-2021-44964SUSE bug 1197165cpe:/o:suse:suse-microos:5.0CVE-2021-45095SUSE Linux Enterprise Micro 5.0
pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
ModerateCVE-2021-45095SUSE bug 1193867cpe:/o:suse:suse-microos:5.0CVE-2021-45100SUSE Linux Enterprise Micro 5.0
The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even though encryption has been enabled. This occurs because it sets the SMB2_GLOBAL_CAP_ENCRYPTION flag when using the SMB 3.1.1 protocol, which is a violation of the SMB protocol specification. When Windows 10 detects this protocol violation, it disables encryption.
ImportantCVE-2021-45100SUSE bug 1193865cpe:/o:suse:suse-microos:5.0CVE-2021-45402SUSE Linux Enterprise Micro 5.0
The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a "pointer leak."
ModerateCVE-2021-45402SUSE bug 1196130cpe:/o:suse:suse-microos:5.0CVE-2021-45469SUSE Linux Enterprise Micro 5.0
In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entry.
ImportantCVE-2021-45469SUSE bug 1194060SUSE bug 1194462cpe:/o:suse:suse-microos:5.0CVE-2021-45480SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.15.11. There is a memory leak in the __rds_conn_create() function in net/rds/connection.c in a certain combination of circumstances.
LowCVE-2021-45480SUSE bug 1194090cpe:/o:suse:suse-microos:5.0CVE-2021-45485SUSE Linux Enterprise Micro 5.0
In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses.
LowCVE-2021-45485SUSE bug 1194094cpe:/o:suse:suse-microos:5.0CVE-2021-45486SUSE Linux Enterprise Micro 5.0
In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.
LowCVE-2021-45486SUSE bug 1194087cpe:/o:suse:suse-microos:5.0CVE-2021-45868SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file.
ModerateCVE-2021-45868SUSE bug 1197366cpe:/o:suse:suse-microos:5.0CVE-2021-45931SUSE Linux Enterprise Micro 5.0
HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from hb_sparseset_t<hb_bit_set_invertible_t>::set and hb_set_copy).
ImportantCVE-2021-45931SUSE bug 1194218cpe:/o:suse:suse-microos:5.0CVE-2021-45960SUSE Linux Enterprise Micro 5.0
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
ModerateCVE-2021-45960SUSE bug 1194251cpe:/o:suse:suse-microos:5.0CVE-2021-46059SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
ModerateCVE-2021-46059SUSE bug 1194556cpe:/o:suse:suse-microos:5.0CVE-2021-46143SUSE Linux Enterprise Micro 5.0
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
ImportantCVE-2021-46143SUSE bug 1194362SUSE bug 1195327SUSE bug 1196387SUSE bug 1200038SUSE bug 1200198cpe:/o:suse:suse-microos:5.0CVE-2021-46283SUSE Linux Enterprise Micro 5.0
nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace.
ModerateCVE-2021-46283SUSE bug 1194518cpe:/o:suse:suse-microos:5.0CVE-2021-46705SUSE Linux Enterprise Micro 5.0
A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1.
ModerateCVE-2021-46705SUSE bug 1190474cpe:/o:suse:suse-microos:5.0CVE-2022-0001SUSE Linux Enterprise Micro 5.0
Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
ModerateCVE-2022-0001SUSE bug 1191580SUSE bug 1196901cpe:/o:suse:suse-microos:5.0CVE-2022-0002SUSE Linux Enterprise Micro 5.0
Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
ModerateCVE-2022-0002SUSE bug 1191580SUSE bug 1196901cpe:/o:suse:suse-microos:5.0CVE-2022-0128SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Out-of-bounds Read
LowCVE-2022-0128SUSE bug 1194388cpe:/o:suse:suse-microos:5.0CVE-2022-0135SUSE Linux Enterprise Micro 5.0
An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a specially crafted virgil resource and then issue a VIRTGPU_EXECBUFFER ioctl, leading to a denial of service or possible code execution.
ImportantCVE-2022-0135SUSE bug 1195389SUSE bug 1196396cpe:/o:suse:suse-microos:5.0CVE-2022-0156SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Use After Free
ModerateCVE-2022-0156SUSE bug 1194559cpe:/o:suse:suse-microos:5.0CVE-2022-0158SUSE Linux Enterprise Micro 5.0
vim is vulnerable to Heap-based Buffer Overflow
ModerateCVE-2022-0158SUSE bug 1194553cpe:/o:suse:suse-microos:5.0CVE-2022-0168SUSE Linux Enterprise Micro 5.0
A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.
ModerateCVE-2022-0168SUSE bug 1197472cpe:/o:suse:suse-microos:5.0CVE-2022-0171SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV).
ModerateCVE-2022-0171SUSE bug 1199509cpe:/o:suse:suse-microos:5.0CVE-2022-0175SUSE Linux Enterprise Micro 5.0
A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure.
ModerateCVE-2022-0175SUSE bug 1194601cpe:/o:suse:suse-microos:5.0CVE-2022-0185SUSE Linux Enterprise Micro 5.0
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
ImportantCVE-2022-0185SUSE bug 1194517SUSE bug 1194737cpe:/o:suse:suse-microos:5.0CVE-2022-0264SUSE Linux Enterprise Micro 5.0
A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6
ModerateCVE-2022-0264SUSE bug 1194826cpe:/o:suse:suse-microos:5.0CVE-2022-0286SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of service.
ModerateCVE-2022-0286SUSE bug 1195371cpe:/o:suse:suse-microos:5.0CVE-2022-0318SUSE Linux Enterprise Micro 5.0
Heap-based Buffer Overflow in vim/vim prior to 8.2.
ModerateCVE-2022-0318SUSE bug 1195004cpe:/o:suse:suse-microos:5.0CVE-2022-0319SUSE Linux Enterprise Micro 5.0
Out-of-bounds Read in vim/vim prior to 8.2.
LowCVE-2022-0319SUSE bug 1195066cpe:/o:suse:suse-microos:5.0CVE-2022-0322SUSE Linux Enterprise Micro 5.0
A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS).
ModerateCVE-2022-0322SUSE bug 1194985cpe:/o:suse:suse-microos:5.0CVE-2022-0330SUSE Linux Enterprise Micro 5.0
A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.
ModerateCVE-2022-0330SUSE bug 1194880SUSE bug 1195950cpe:/o:suse:suse-microos:5.0CVE-2022-0351SUSE Linux Enterprise Micro 5.0
Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
LowCVE-2022-0351SUSE bug 1195126cpe:/o:suse:suse-microos:5.0CVE-2022-0358SUSE Linux Enterprise Micro 5.0
A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.
ModerateCVE-2022-0358SUSE bug 1195161cpe:/o:suse:suse-microos:5.0CVE-2022-0361SUSE Linux Enterprise Micro 5.0
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
ModerateCVE-2022-0361SUSE bug 1195202cpe:/o:suse:suse-microos:5.0CVE-2022-0368SUSE Linux Enterprise Micro 5.0
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
ModerateCVE-2022-0368SUSE bug 1195205cpe:/o:suse:suse-microos:5.0CVE-2022-0382SUSE Linux Enterprise Micro 5.0
An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes, and the user cannot control what is read. This flaw affects the Linux kernel versions prior to 5.17-rc1.
ModerateCVE-2022-0382SUSE bug 1195199cpe:/o:suse:suse-microos:5.0CVE-2022-0393SUSE Linux Enterprise Micro 5.0
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
ModerateCVE-2022-0393SUSE bug 1195336cpe:/o:suse:suse-microos:5.0CVE-2022-0407SUSE Linux Enterprise Micro 5.0
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
ImportantCVE-2022-0407SUSE bug 1195354SUSE bug 1208308SUSE bug 1208649SUSE bug 1208651cpe:/o:suse:suse-microos:5.0CVE-2022-0408SUSE Linux Enterprise Micro 5.0
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
ModerateCVE-2022-0408SUSE bug 1195459cpe:/o:suse:suse-microos:5.0CVE-2022-0413SUSE Linux Enterprise Micro 5.0
Use After Free in GitHub repository vim/vim prior to 8.2.
ImportantCVE-2022-0413SUSE bug 1195356SUSE bug 1208308SUSE bug 1208651cpe:/o:suse:suse-microos:5.0CVE-2022-0417SUSE Linux Enterprise Micro 5.0
Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.
ModerateCVE-2022-0417SUSE bug 1195499cpe:/o:suse:suse-microos:5.0CVE-2022-0433SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kernel versions prior to 5.17-rc1.
ModerateCVE-2022-0433SUSE bug 1195373cpe:/o:suse:suse-microos:5.0CVE-2022-0435SUSE Linux Enterprise Micro 5.0
A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.
ImportantCVE-2022-0435SUSE bug 1195254SUSE bug 1195308cpe:/o:suse:suse-microos:5.0CVE-2022-0443SUSE Linux Enterprise Micro 5.0
Use After Free in GitHub repository vim/vim prior to 8.2.
ModerateCVE-2022-0443SUSE bug 1195509cpe:/o:suse:suse-microos:5.0CVE-2022-0487SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.
ModerateCVE-2022-0487SUSE bug 1194516SUSE bug 1195949SUSE bug 1198615cpe:/o:suse:suse-microos:5.0CVE-2022-0492SUSE Linux Enterprise Micro 5.0
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
ModerateCVE-2022-0492SUSE bug 1195543SUSE bug 1195908SUSE bug 1196612SUSE bug 1196776SUSE bug 1198615SUSE bug 1199255SUSE bug 1199615SUSE bug 1200084cpe:/o:suse:suse-microos:5.0CVE-2022-0494SUSE Linux Enterprise Micro 5.0
A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality.
ModerateCVE-2022-0494SUSE bug 1197386SUSE bug 1207783cpe:/o:suse:suse-microos:5.0CVE-2022-0500SUSE Linux Enterprise Micro 5.0
A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system.
ImportantCVE-2022-0500SUSE bug 1196261SUSE bug 1196811cpe:/o:suse:suse-microos:5.0CVE-2022-0516SUSE Linux Enterprise Micro 5.0
A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.
ImportantCVE-2022-0516SUSE bug 1195516SUSE bug 1195947cpe:/o:suse:suse-microos:5.0CVE-2022-0554SUSE Linux Enterprise Micro 5.0
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.
ModerateCVE-2022-0554SUSE bug 1195846cpe:/o:suse:suse-microos:5.0CVE-2022-0563SUSE Linux Enterprise Micro 5.0
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.
ModerateCVE-2022-0563SUSE bug 1196241cpe:/o:suse:suse-microos:5.0CVE-2022-0572SUSE Linux Enterprise Micro 5.0
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
ModerateCVE-2022-0572SUSE bug 1196023cpe:/o:suse:suse-microos:5.0CVE-2022-0615SUSE Linux Enterprise Micro 5.0
Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-service condition on the system.
ImportantCVE-2022-0615SUSE bug 1196541cpe:/o:suse:suse-microos:5.0CVE-2022-0617SUSE Linux Enterprise Micro 5.0
A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.
ModerateCVE-2022-0617SUSE bug 1196079cpe:/o:suse:suse-microos:5.0CVE-2022-0629SUSE Linux Enterprise Micro 5.0
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
ModerateCVE-2022-0629SUSE bug 1196226cpe:/o:suse:suse-microos:5.0CVE-2022-0644SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
ModerateCVE-2022-0644SUSE bug 1196155cpe:/o:suse:suse-microos:5.0CVE-2022-0646SUSE Linux Enterprise Micro 5.0
A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after the unregister_netdev during removing device. A local user could use this flaw to crash the system or escalate their privileges on the system. It is actual from Linux Kernel 5.17-rc1 (when mctp-serial.c introduced) till 5.17-rc5.
ModerateCVE-2022-0646SUSE bug 1196090cpe:/o:suse:suse-microos:5.0CVE-2022-0685SUSE Linux Enterprise Micro 5.0
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.
ImportantCVE-2022-0685SUSE bug 1196227cpe:/o:suse:suse-microos:5.0CVE-2022-0696SUSE Linux Enterprise Micro 5.0
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.
LowCVE-2022-0696SUSE bug 1196361SUSE bug 1205395cpe:/o:suse:suse-microos:5.0CVE-2022-0714SUSE Linux Enterprise Micro 5.0
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.
ModerateCVE-2022-0714SUSE bug 1196358cpe:/o:suse:suse-microos:5.0CVE-2022-0729SUSE Linux Enterprise Micro 5.0
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440.
LowCVE-2022-0729SUSE bug 1196437cpe:/o:suse:suse-microos:5.0CVE-2022-0742SUSE Linux Enterprise Micro 5.0
Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit 2d3916f3189172d5c69d33065c3c21119fe539fc.
ImportantCVE-2022-0742SUSE bug 1197128SUSE bug 1197129cpe:/o:suse:suse-microos:5.0CVE-2022-0778SUSE Linux Enterprise Micro 5.0
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).
ImportantCVE-2022-0778SUSE bug 1196877SUSE bug 1197328SUSE bug 1197340SUSE bug 1199100SUSE bug 1199254SUSE bug 1199303SUSE bug 1199339SUSE bug 1200090cpe:/o:suse:suse-microos:5.0CVE-2022-0847SUSE Linux Enterprise Micro 5.0
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
ImportantCVE-2022-0847SUSE bug 1196584SUSE bug 1196601cpe:/o:suse:suse-microos:5.0CVE-2022-0850SUSE Linux Enterprise Micro 5.0
A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.
ModerateCVE-2022-0850SUSE bug 1196761cpe:/o:suse:suse-microos:5.0CVE-2022-0854SUSE Linux Enterprise Micro 5.0
A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.
ModerateCVE-2022-0854SUSE bug 1196823cpe:/o:suse:suse-microos:5.0CVE-2022-0934SUSE Linux Enterprise Micro 5.0
A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service.
ModerateCVE-2022-0934SUSE bug 1197872cpe:/o:suse:suse-microos:5.0CVE-2022-0943SUSE Linux Enterprise Micro 5.0
Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.
ImportantCVE-2022-0943SUSE bug 1197225cpe:/o:suse:suse-microos:5.0CVE-2022-0995SUSE Linux Enterprise Micro 5.0
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.
ImportantCVE-2022-0995SUSE bug 1197246SUSE bug 1197337cpe:/o:suse:suse-microos:5.0CVE-2022-0998SUSE Linux Enterprise Micro 5.0
An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potentially escalate their privileges on the system.
ModerateCVE-2022-0998SUSE bug 1197247SUSE bug 1197338cpe:/o:suse:suse-microos:5.0CVE-2022-1016SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.
ImportantCVE-2022-1016SUSE bug 1197335cpe:/o:suse:suse-microos:5.0CVE-2022-1043SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel’s io_uring implementation. This flaw allows an attacker with a local account to corrupt system memory, crash the system or escalate privileges.
ImportantCVE-2022-1043SUSE bug 1197393SUSE bug 1197596cpe:/o:suse:suse-microos:5.0CVE-2022-1048SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.
ImportantCVE-2022-1048SUSE bug 1197331SUSE bug 1197597SUSE bug 1200041SUSE bug 1204132SUSE bug 1212325cpe:/o:suse:suse-microos:5.0CVE-2022-1055SUSE Linux Enterprise Micro 5.0
A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
ImportantCVE-2022-1055SUSE bug 1197702SUSE bug 1197705cpe:/o:suse:suse-microos:5.0CVE-2022-1097SUSE Linux Enterprise Micro 5.0
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
ImportantCVE-2022-1097cpe:/o:suse:suse-microos:5.0CVE-2022-1116SUSE Linux Enterprise Micro 5.0
Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to 5.4.189; version 5.4.24 and later versions.
ImportantCVE-2022-1116SUSE bug 1199647SUSE bug 1199648SUSE bug 1209225cpe:/o:suse:suse-microos:5.0CVE-2022-1154SUSE Linux Enterprise Micro 5.0
Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.
ModerateCVE-2022-1154SUSE bug 1197813cpe:/o:suse:suse-microos:5.0CVE-2022-1158SUSE Linux Enterprise Micro 5.0
A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition.
ImportantCVE-2022-1158SUSE bug 1197660SUSE bug 1198133cpe:/o:suse:suse-microos:5.0CVE-2022-1160SUSE Linux Enterprise Micro 5.0
heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.
ModerateCVE-2022-1160SUSE bug 1197814cpe:/o:suse:suse-microos:5.0CVE-2022-1195SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early.
ModerateCVE-2022-1195SUSE bug 1198029cpe:/o:suse:suse-microos:5.0CVE-2022-1198SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.
ModerateCVE-2022-1198SUSE bug 1198030cpe:/o:suse:suse-microos:5.0CVE-2022-1199SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.
ModerateCVE-2022-1199SUSE bug 1198028cpe:/o:suse:suse-microos:5.0CVE-2022-1204SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.
ModerateCVE-2022-1204SUSE bug 1198025cpe:/o:suse:suse-microos:5.0CVE-2022-1205SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.
ModerateCVE-2022-1205SUSE bug 1198027cpe:/o:suse:suse-microos:5.0CVE-2022-1247SUSE Linux Enterprise Micro 5.0
An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many objects are using the rose_neigh. When a user wants to delete a rose_route via rose_ioctl(), the rose driver calls rose_del_node() and removes neighbours only if their “count” and “use” are zero.
ModerateCVE-2022-1247SUSE bug 1199434SUSE bug 1199696SUSE bug 1204132cpe:/o:suse:suse-microos:5.0CVE-2022-1263SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.
ModerateCVE-2022-1263SUSE bug 1198189cpe:/o:suse:suse-microos:5.0CVE-2022-1271SUSE Linux Enterprise Micro 5.0
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.
ImportantCVE-2022-1271SUSE bug 1198062SUSE bug 1198812SUSE bug 1199107SUSE bug 1199108cpe:/o:suse:suse-microos:5.0CVE-2022-1280SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of service (DoS) or a kernel information leak.
ModerateCVE-2022-1280SUSE bug 1197914SUSE bug 1198590cpe:/o:suse:suse-microos:5.0CVE-2022-1292SUSE Linux Enterprise Micro 5.0
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).
ModerateCVE-2022-1292SUSE bug 1199166SUSE bug 1200550SUSE bug 1200650SUSE bug 1200758SUSE bug 1202688cpe:/o:suse:suse-microos:5.0CVE-2022-1304SUSE Linux Enterprise Micro 5.0
An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.
ModerateCVE-2022-1304SUSE bug 1198446SUSE bug 1201130cpe:/o:suse:suse-microos:5.0CVE-2022-1343SUSE Linux Enterprise Micro 5.0
The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
ModerateCVE-2022-1343SUSE bug 1199167cpe:/o:suse:suse-microos:5.0CVE-2022-1348SUSE Linux Enterprise Micro 5.0
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
ModerateCVE-2022-1348SUSE bug 1199652cpe:/o:suse:suse-microos:5.0CVE-2022-1381SUSE Linux Enterprise Micro 5.0
global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
ModerateCVE-2022-1381SUSE bug 1198596cpe:/o:suse:suse-microos:5.0CVE-2022-1420SUSE Linux Enterprise Micro 5.0
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.
LowCVE-2022-1420SUSE bug 1198748cpe:/o:suse:suse-microos:5.0CVE-2022-1434SUSE Linux Enterprise Micro 5.0
The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check. Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0 endpoint will always be rejected by the recipient and the connection will fail at that point. Many application protocols require data to be sent from the client to the server first. Therefore, in such a case, only an OpenSSL 3.0 server would be impacted when talking to a non-OpenSSL 3.0 client. If both endpoints are OpenSSL 3.0 then the attacker could modify data being sent in both directions. In this case both clients and servers could be affected, regardless of the application protocol. Note that in the absence of an attacker this bug means that an OpenSSL 3.0 endpoint communicating with a non-OpenSSL 3.0 endpoint will fail to complete the handshake when using this ciphersuite. The confidentiality of data is not impacted by this issue, i.e. an attacker cannot decrypt data that has been encrypted using this ciphersuite - they can only modify it. In order for this attack to work both endpoints must legitimately negotiate the RC4-MD5 ciphersuite. This ciphersuite is not compiled by default in OpenSSL 3.0, and is not available within the default provider or the default ciphersuite list. This ciphersuite will never be used if TLSv1.3 has been negotiated. In order for an OpenSSL 3.0 endpoint to use this ciphersuite the following must have occurred: 1) OpenSSL must have been compiled with the (non-default) compile time option enable-weak-ssl-ciphers 2) OpenSSL must have had the legacy provider explicitly loaded (either through application code or via configuration) 3) The ciphersuite must have been explicitly added to the ciphersuite list 4) The libssl security level must have been set to 0 (default is 1) 5) A version of SSL/TLS below TLSv1.3 must have been negotiated 6) Both endpoints must negotiate the RC4-MD5 ciphersuite in preference to any others that both endpoints have in common Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
ImportantCVE-2022-1434SUSE bug 1199168cpe:/o:suse:suse-microos:5.0CVE-2022-1473SUSE Linux Enterprise Micro 5.0
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
ImportantCVE-2022-1473SUSE bug 1199168SUSE bug 1199169cpe:/o:suse:suse-microos:5.0CVE-2022-1508SUSE Linux Enterprise Micro 5.0
An out-of-bounds read flaw was found in the Linux kernel’s io_uring module in the way a user triggers the io_read() function with some special parameters. This flaw allows a local user to read some memory out of bounds.
ModerateCVE-2022-1508SUSE bug 1198968cpe:/o:suse:suse-microos:5.0CVE-2022-1587SUSE Linux Enterprise Micro 5.0
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.
ImportantCVE-2022-1587SUSE bug 1199235SUSE bug 1201754SUSE bug 1203032cpe:/o:suse:suse-microos:5.0CVE-2022-1619SUSE Linux Enterprise Micro 5.0
Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution
ModerateCVE-2022-1619SUSE bug 1199333cpe:/o:suse:suse-microos:5.0CVE-2022-1621SUSE Linux Enterprise Micro 5.0
Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
ModerateCVE-2022-1621SUSE bug 1199435cpe:/o:suse:suse-microos:5.0CVE-2022-1629SUSE Linux Enterprise Micro 5.0
Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution
ModerateCVE-2022-1629SUSE bug 1199436cpe:/o:suse:suse-microos:5.0CVE-2022-1651SUSE Linux Enterprise Micro 5.0
A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emulates virtual NICs in VM. This flaw allows a local privileged attacker to leak unauthorized kernel information, causing a denial of service.
ModerateCVE-2022-1651SUSE bug 1199433cpe:/o:suse:suse-microos:5.0CVE-2022-1671SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel. This flaw allows a local attacker to crash the system or leak internal kernel information.
ModerateCVE-2022-1671SUSE bug 1199439cpe:/o:suse:suse-microos:5.0CVE-2022-1674SUSE Linux Enterprise Micro 5.0
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input.
LowCVE-2022-1674SUSE bug 1199502cpe:/o:suse:suse-microos:5.0CVE-2022-1678SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients.
ModerateCVE-2022-1678SUSE bug 1199939cpe:/o:suse:suse-microos:5.0CVE-2022-1733SUSE Linux Enterprise Micro 5.0
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968.
LowCVE-2022-1733SUSE bug 1199655cpe:/o:suse:suse-microos:5.0CVE-2022-1769SUSE Linux Enterprise Micro 5.0
Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974.
ModerateCVE-2022-1769SUSE bug 1199658cpe:/o:suse:suse-microos:5.0CVE-2022-1789SUSE Linux Enterprise Micro 5.0
With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
ModerateCVE-2022-1789SUSE bug 1199674cpe:/o:suse:suse-microos:5.0CVE-2022-1851SUSE Linux Enterprise Micro 5.0
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
LowCVE-2022-1851SUSE bug 1199936cpe:/o:suse:suse-microos:5.0CVE-2022-1852SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU.
ModerateCVE-2022-1852SUSE bug 1199875cpe:/o:suse:suse-microos:5.0CVE-2022-1882SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system.
ImportantCVE-2022-1882SUSE bug 1199904SUSE bug 1200058cpe:/o:suse:suse-microos:5.0CVE-2022-1886SUSE Linux Enterprise Micro 5.0
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
LowCVE-2022-1886SUSE bug 1199969cpe:/o:suse:suse-microos:5.0CVE-2022-1927SUSE Linux Enterprise Micro 5.0
Buffer Over-read in GitHub repository vim/vim prior to 8.2.
ModerateCVE-2022-1927SUSE bug 1200012cpe:/o:suse:suse-microos:5.0CVE-2022-1943SUSE Linux Enterprise Micro 5.0
A flaw out of bounds memory write in the Linux kernel UDF file system functionality was found in the way user triggers some file operation which triggers udf_write_fi(). A local user could use this flaw to crash the system or potentially
ModerateCVE-2022-1943SUSE bug 1200055cpe:/o:suse:suse-microos:5.0CVE-2022-1966SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
ImportantCVE-2022-1966SUSE bug 1200015SUSE bug 1200268SUSE bug 1200494SUSE bug 1200529cpe:/o:suse:suse-microos:5.0CVE-2022-1972SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2078. Reason: This candidate is a reservation duplicate of CVE-2022-2078. Notes: All CVE users should reference CVE-2022-2078 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
ModerateCVE-2022-1972SUSE bug 1200019SUSE bug 1200266cpe:/o:suse:suse-microos:5.0CVE-2022-1973SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal. This flaw allows a local attacker to crash the system and leads to a kernel information leak problem.
ImportantCVE-2022-1973SUSE bug 1200023cpe:/o:suse:suse-microos:5.0CVE-2022-1998SUSE Linux Enterprise Micro 5.0
A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
ModerateCVE-2022-1998SUSE bug 1200284cpe:/o:suse:suse-microos:5.0CVE-2022-20009SUSE Linux Enterprise Micro 5.0
In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-213172319References: Upstream kernel
ModerateCVE-2022-20009SUSE bug 1199566cpe:/o:suse:suse-microos:5.0CVE-2022-20117SUSE Linux Enterprise Micro 5.0
In (TBD) of (TBD), there is a possible way to decrypt local data encrypted by the GSC due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-217475903References: N/A
LowCVE-2022-20117SUSE bug 1199569cpe:/o:suse:suse-microos:5.0CVE-2022-20118SUSE Linux Enterprise Micro 5.0
In ion_ioctl and related functions of ion.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205707793References: N/A
ModerateCVE-2022-20118SUSE bug 1199570cpe:/o:suse:suse-microos:5.0CVE-2022-20119SUSE Linux Enterprise Micro 5.0
In private_handle_t of mali_gralloc_buffer.h, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-213170715References: N/A
LowCVE-2022-20119SUSE bug 1199563cpe:/o:suse:suse-microos:5.0CVE-2022-20148SUSE Linux Enterprise Micro 5.0
In TBD of TBD, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-219513976References: Upstream kernel
ModerateCVE-2022-20148SUSE bug 1200610cpe:/o:suse:suse-microos:5.0CVE-2022-20153SUSE Linux Enterprise Micro 5.0
In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-222091980References: Upstream kernel
ModerateCVE-2022-20153SUSE bug 1200609cpe:/o:suse:suse-microos:5.0CVE-2022-20158SUSE Linux Enterprise Micro 5.0
In bdi_put and bdi_unregister of backing-dev.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182815710References: Upstream kernel
ModerateCVE-2022-20158SUSE bug 1202345cpe:/o:suse:suse-microos:5.0CVE-2022-20371SUSE Linux Enterprise Micro 5.0
In dm_bow_dtr and related functions of dm-bow.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-195565510References: Upstream kernel
ModerateCVE-2022-20371SUSE bug 1202348cpe:/o:suse:suse-microos:5.0CVE-2022-20382SUSE Linux Enterprise Micro 5.0
In (TBD) of (TBD), there is a possible out of bounds write due to kernel stack overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-214245176References: Upstream kernel
ModerateCVE-2022-20382SUSE bug 1202349cpe:/o:suse:suse-microos:5.0CVE-2022-2078SUSE Linux Enterprise Micro 5.0
A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and possibly to run code.
ModerateCVE-2022-2078cpe:/o:suse:suse-microos:5.0CVE-2022-21505SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2022-21505SUSE bug 1201458cpe:/o:suse:suse-microos:5.0CVE-2022-2196SUSE Linux Enterprise Micro 5.0
A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.?L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB?after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit?2e7eab81425a
ModerateCVE-2022-2196SUSE bug 1206992cpe:/o:suse:suse-microos:5.0CVE-2022-22058SUSE Linux Enterprise Micro 5.0
Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
ImportantCVE-2022-22058SUSE bug 1203777cpe:/o:suse:suse-microos:5.0CVE-2022-22075SUSE Linux Enterprise Micro 5.0
Information Disclosure in Graphics during GPU context switch.
ModerateCVE-2022-22075SUSE bug 1209195cpe:/o:suse:suse-microos:5.0CVE-2022-2209SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.
ModerateCVE-2022-2209SUSE bug 1201828cpe:/o:suse:suse-microos:5.0CVE-2022-22822SUSE Linux Enterprise Micro 5.0
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
ImportantCVE-2022-22822SUSE bug 1194474SUSE bug 1195327SUSE bug 1200038SUSE bug 1200198cpe:/o:suse:suse-microos:5.0CVE-2022-22823SUSE Linux Enterprise Micro 5.0
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
ImportantCVE-2022-22823SUSE bug 1194476SUSE bug 1195327SUSE bug 1200038SUSE bug 1200198cpe:/o:suse:suse-microos:5.0CVE-2022-22824SUSE Linux Enterprise Micro 5.0
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
ImportantCVE-2022-22824SUSE bug 1194477SUSE bug 1195327SUSE bug 1200038SUSE bug 1200198cpe:/o:suse:suse-microos:5.0CVE-2022-22825SUSE Linux Enterprise Micro 5.0
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
ImportantCVE-2022-22825SUSE bug 1194478SUSE bug 1195327SUSE bug 1200038SUSE bug 1200198cpe:/o:suse:suse-microos:5.0CVE-2022-22826SUSE Linux Enterprise Micro 5.0
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
ImportantCVE-2022-22826SUSE bug 1194479SUSE bug 1195327SUSE bug 1200038SUSE bug 1200198cpe:/o:suse:suse-microos:5.0CVE-2022-22827SUSE Linux Enterprise Micro 5.0
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
ImportantCVE-2022-22827SUSE bug 1194480SUSE bug 1195327SUSE bug 1200038SUSE bug 1200198cpe:/o:suse:suse-microos:5.0CVE-2022-22934SUSE Linux Enterprise Micro 5.0
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
ImportantCVE-2022-22934SUSE bug 1197417SUSE bug 1197765cpe:/o:suse:suse-microos:5.0CVE-2022-22935SUSE Linux Enterprise Micro 5.0
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.
ImportantCVE-2022-22935SUSE bug 1197417SUSE bug 1197765cpe:/o:suse:suse-microos:5.0CVE-2022-22936SUSE Linux Enterprise Micro 5.0
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios.
ImportantCVE-2022-22936SUSE bug 1197417SUSE bug 1197765cpe:/o:suse:suse-microos:5.0CVE-2022-22941SUSE Linux Enterprise Micro 5.0
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.
ImportantCVE-2022-22941SUSE bug 1197417SUSE bug 1197765cpe:/o:suse:suse-microos:5.0CVE-2022-22942SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2022-22942SUSE bug 1195065SUSE bug 1195951cpe:/o:suse:suse-microos:5.0CVE-2022-23033SUSE Linux Enterprise Micro 5.0
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
ImportantCVE-2022-23033SUSE bug 1194576cpe:/o:suse:suse-microos:5.0CVE-2022-23034SUSE Linux Enterprise Micro 5.0
A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case where a PV guest would have the IOMMU enabled. PV guests can request two forms of mappings. When both are in use for any individual mapping, unmapping of such a mapping can be requested in two steps. The reference count for such a mapping would then mistakenly be decremented twice. Underflow of the counters gets detected, resulting in the triggering of a hypervisor bug check.
LowCVE-2022-23034SUSE bug 1194581cpe:/o:suse:suse-microos:5.0CVE-2022-23035SUSE Linux Enterprise Micro 5.0
Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular when cleaning up after the guest's use of the device. In the case where an interrupt is not quiescent yet at the time this cleanup gets invoked, the cleanup attempt may be scheduled to be retried. When multiple interrupts are involved, this scheduling of a retry may get erroneously skipped. At the same time pointers may get cleared (resulting in a de-reference of NULL) and freed (resulting in a use-after-free), while other code would continue to assume them to be valid.
ModerateCVE-2022-23035SUSE bug 1194588cpe:/o:suse:suse-microos:5.0CVE-2022-23036SUSE Linux Enterprise Micro 5.0
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042
ImportantCVE-2022-23036SUSE bug 1196488SUSE bug 1199099SUSE bug 1199141SUSE bug 1204132cpe:/o:suse:suse-microos:5.0CVE-2022-23037SUSE Linux Enterprise Micro 5.0
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042
ImportantCVE-2022-23037SUSE bug 1199099SUSE bug 1199141SUSE bug 1204132cpe:/o:suse:suse-microos:5.0CVE-2022-23038SUSE Linux Enterprise Micro 5.0
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042
ImportantCVE-2022-23038SUSE bug 1199099SUSE bug 1199141SUSE bug 1204132cpe:/o:suse:suse-microos:5.0CVE-2022-23039SUSE Linux Enterprise Micro 5.0
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042
ImportantCVE-2022-23039SUSE bug 1199099SUSE bug 1199141SUSE bug 1204132cpe:/o:suse:suse-microos:5.0CVE-2022-23040SUSE Linux Enterprise Micro 5.0
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042
ImportantCVE-2022-23040SUSE bug 1199099SUSE bug 1199141SUSE bug 1204132cpe:/o:suse:suse-microos:5.0CVE-2022-23041SUSE Linux Enterprise Micro 5.0
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042
ImportantCVE-2022-23041SUSE bug 1199099SUSE bug 1199141SUSE bug 1204132cpe:/o:suse:suse-microos:5.0CVE-2022-23042SUSE Linux Enterprise Micro 5.0
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042
ImportantCVE-2022-23042SUSE bug 1199099SUSE bug 1199141SUSE bug 1204132cpe:/o:suse:suse-microos:5.0CVE-2022-2308SUSE Linux Enterprise Micro 5.0
A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.
ModerateCVE-2022-2308SUSE bug 1202573cpe:/o:suse:suse-microos:5.0CVE-2022-23218SUSE Linux Enterprise Micro 5.0
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
ModerateCVE-2022-23218SUSE bug 1194770SUSE bug 1199869SUSE bug 1200036cpe:/o:suse:suse-microos:5.0CVE-2022-23219SUSE Linux Enterprise Micro 5.0
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
ModerateCVE-2022-23219SUSE bug 1194768SUSE bug 1199869SUSE bug 1200036cpe:/o:suse:suse-microos:5.0CVE-2022-23222SUSE Linux Enterprise Micro 5.0
kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types.
ModerateCVE-2022-23222SUSE bug 1194765cpe:/o:suse:suse-microos:5.0CVE-2022-2327SUSE Linux Enterprise Micro 5.0
io_uring use work_flags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORING_OP. Some operations are missing some types, which can lead to incorrect reference counts which can then lead to a double free. We recommend upgrading the kernel past commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859
ModerateCVE-2022-2327SUSE bug 1201829cpe:/o:suse:suse-microos:5.0CVE-2022-23303SUSE Linux Enterprise Micro 5.0
The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.
ImportantCVE-2022-23303SUSE bug 1194732SUSE bug 1205064cpe:/o:suse:suse-microos:5.0CVE-2022-23304SUSE Linux Enterprise Micro 5.0
The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.
ImportantCVE-2022-23304SUSE bug 1194733SUSE bug 1205064cpe:/o:suse:suse-microos:5.0CVE-2022-23648SUSE Linux Enterprise Micro 5.0
containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.
ModerateCVE-2022-23648SUSE bug 1196441cpe:/o:suse:suse-microos:5.0CVE-2022-2380SUSE Linux Enterprise Micro 5.0
The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers being able to crash the kernel.
ModerateCVE-2022-2380SUSE bug 1201378cpe:/o:suse:suse-microos:5.0CVE-2022-23816SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
ModerateCVE-2022-23816SUSE bug 1201456SUSE bug 1201469cpe:/o:suse:suse-microos:5.0CVE-2022-23852SUSE Linux Enterprise Micro 5.0
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
ImportantCVE-2022-23852SUSE bug 1195054SUSE bug 1196480SUSE bug 1200038SUSE bug 1200198cpe:/o:suse:suse-microos:5.0CVE-2022-23990SUSE Linux Enterprise Micro 5.0
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
ImportantCVE-2022-23990SUSE bug 1195217SUSE bug 1196480SUSE bug 1200038SUSE bug 1200198cpe:/o:suse:suse-microos:5.0CVE-2022-24122SUSE Linux Enterprise Micro 5.0
kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace.
ImportantCVE-2022-24122SUSE bug 1195306SUSE bug 1196028cpe:/o:suse:suse-microos:5.0CVE-2022-24407SUSE Linux Enterprise Micro 5.0
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
ImportantCVE-2022-24407SUSE bug 1196036SUSE bug 1198600SUSE bug 1199112SUSE bug 1199494SUSE bug 1200197SUSE bug 1200200cpe:/o:suse:suse-microos:5.0CVE-2022-24448SUSE Linux Enterprise Micro 5.0
An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.
ModerateCVE-2022-24448SUSE bug 1195612cpe:/o:suse:suse-microos:5.0CVE-2022-24769SUSE Linux Enterprise Micro 5.0
Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.
ModerateCVE-2022-24769SUSE bug 1197517cpe:/o:suse:suse-microos:5.0CVE-2022-24958SUSE Linux Enterprise Micro 5.0
drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
ModerateCVE-2022-24958SUSE bug 1195905cpe:/o:suse:suse-microos:5.0CVE-2022-24959SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.
ModerateCVE-2022-24959SUSE bug 1195897cpe:/o:suse:suse-microos:5.0CVE-2022-25235SUSE Linux Enterprise Micro 5.0
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
ImportantCVE-2022-25235SUSE bug 1196026SUSE bug 1197217SUSE bug 1198587SUSE bug 1200038SUSE bug 1200198SUSE bug 1201735cpe:/o:suse:suse-microos:5.0CVE-2022-25236SUSE Linux Enterprise Micro 5.0
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
ImportantCVE-2022-25236SUSE bug 1196025SUSE bug 1196784SUSE bug 1197217SUSE bug 1200038SUSE bug 1201735cpe:/o:suse:suse-microos:5.0CVE-2022-25258SUSE Linux Enterprise Micro 5.0
An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.
ImportantCVE-2022-25258SUSE bug 1196095SUSE bug 1196132cpe:/o:suse:suse-microos:5.0CVE-2022-25265SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of a file.
ImportantCVE-2022-25265SUSE bug 1196134cpe:/o:suse:suse-microos:5.0CVE-2022-25313SUSE Linux Enterprise Micro 5.0
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
ModerateCVE-2022-25313SUSE bug 1196168cpe:/o:suse:suse-microos:5.0CVE-2022-25314SUSE Linux Enterprise Micro 5.0
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
ImportantCVE-2022-25314SUSE bug 1196169SUSE bug 1197217SUSE bug 1198587SUSE bug 1199096SUSE bug 1200038SUSE bug 1200198cpe:/o:suse:suse-microos:5.0CVE-2022-25315SUSE Linux Enterprise Micro 5.0
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
ImportantCVE-2022-25315SUSE bug 1196171SUSE bug 1197217SUSE bug 1198587SUSE bug 1200038SUSE bug 1200198SUSE bug 1201735cpe:/o:suse:suse-microos:5.0CVE-2022-25375SUSE Linux Enterprise Micro 5.0
An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.
ModerateCVE-2022-25375SUSE bug 1196235cpe:/o:suse:suse-microos:5.0CVE-2022-25636SUSE Linux Enterprise Micro 5.0
net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.
ImportantCVE-2022-25636SUSE bug 1196299SUSE bug 1196301cpe:/o:suse:suse-microos:5.0CVE-2022-2585SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ImportantCVE-2022-2585SUSE bug 1202094SUSE bug 1202163cpe:/o:suse:suse-microos:5.0CVE-2022-2586SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2022-2586SUSE bug 1202095SUSE bug 1209719cpe:/o:suse:suse-microos:5.0CVE-2022-2590SUSE Linux Enterprise Micro 5.0
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their privileges on the system.
ImportantCVE-2022-2590SUSE bug 1202013SUSE bug 1202089cpe:/o:suse:suse-microos:5.0CVE-2022-2602SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ImportantCVE-2022-2602SUSE bug 1204228SUSE bug 1205186cpe:/o:suse:suse-microos:5.0CVE-2022-26353SUSE Linux Enterprise Micro 5.0
A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and other unexpected results. Affected QEMU version: 6.2.0.
ImportantCVE-2022-26353SUSE bug 1198711cpe:/o:suse:suse-microos:5.0CVE-2022-26356SUSE Linux Enterprise Micro 5.0
Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4.9) is racy with ongoing log dirty hypercalls. A suitably timed call to XEN_DMOP_track_dirty_vram can enable log dirty while another CPU is still in the process of tearing down the structures related to a previously enabled log dirty mode (XEN_DOMCTL_SHADOW_OP_OFF). This is due to lack of mutually exclusive locking between both operations and can lead to entries being added in already freed slots, resulting in a memory leak.
ModerateCVE-2022-26356SUSE bug 1197423cpe:/o:suse:suse-microos:5.0CVE-2022-26357SUSE Linux Enterprise Micro 5.0
race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed.
ModerateCVE-2022-26357SUSE bug 1197425cpe:/o:suse:suse-microos:5.0CVE-2022-26358SUSE Linux Enterprise Micro 5.0
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
ModerateCVE-2022-26358SUSE bug 1197426cpe:/o:suse:suse-microos:5.0CVE-2022-26359SUSE Linux Enterprise Micro 5.0
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
ModerateCVE-2022-26359SUSE bug 1197426cpe:/o:suse:suse-microos:5.0CVE-2022-26360SUSE Linux Enterprise Micro 5.0
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
ModerateCVE-2022-26360SUSE bug 1197426cpe:/o:suse:suse-microos:5.0CVE-2022-26361SUSE Linux Enterprise Micro 5.0
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
ModerateCVE-2022-26361SUSE bug 1197426cpe:/o:suse:suse-microos:5.0CVE-2022-26490SUSE Linux Enterprise Micro 5.0
st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.
ImportantCVE-2022-26490SUSE bug 1196830SUSE bug 1201656SUSE bug 1201969SUSE bug 1211495cpe:/o:suse:suse-microos:5.0CVE-2022-26878SUSE Linux Enterprise Micro 5.0
drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed).
LowCVE-2022-26878SUSE bug 1197035cpe:/o:suse:suse-microos:5.0CVE-2022-26966SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device.
ModerateCVE-2022-26966SUSE bug 1196836cpe:/o:suse:suse-microos:5.0CVE-2022-27191SUSE Linux Enterprise Micro 5.0
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
ImportantCVE-2022-27191SUSE bug 1197284cpe:/o:suse:suse-microos:5.0CVE-2022-27223SUSE Linux Enterprise Micro 5.0
In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access.
ModerateCVE-2022-27223SUSE bug 1197245cpe:/o:suse:suse-microos:5.0CVE-2022-27666SUSE Linux Enterprise Micro 5.0
A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.
ImportantCVE-2022-27666SUSE bug 1197131SUSE bug 1197133SUSE bug 1197462cpe:/o:suse:suse-microos:5.0CVE-2022-27778SUSE Linux Enterprise Micro 5.0
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.
ModerateCVE-2022-27778SUSE bug 1199220SUSE bug 1202688cpe:/o:suse:suse-microos:5.0CVE-2022-27779SUSE Linux Enterprise Micro 5.0
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
ModerateCVE-2022-27779SUSE bug 1199221cpe:/o:suse:suse-microos:5.0CVE-2022-27780SUSE Linux Enterprise Micro 5.0
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
ModerateCVE-2022-27780SUSE bug 1199222cpe:/o:suse:suse-microos:5.0CVE-2022-2785SUSE Linux Enterprise Micro 5.0
There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpf_sys_bpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAP_BPF can arbitrarily read memory from anywhere on the system. We recommend upgrading past commit 86f44fcec22c
ModerateCVE-2022-2785SUSE bug 1203734cpe:/o:suse:suse-microos:5.0CVE-2022-27950SUSE Linux Enterprise Micro 5.0
In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition.
ModerateCVE-2022-27950SUSE bug 1197646cpe:/o:suse:suse-microos:5.0CVE-2022-28348SUSE Linux Enterprise Micro 5.0
Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p0) allows improper GPU memory operations to reach a use-after-free situation.
CriticalCVE-2022-28348SUSE bug 1199720cpe:/o:suse:suse-microos:5.0CVE-2022-28349SUSE Linux Enterprise Micro 5.0
Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 before r24p0, and Valhall r19p0 through r23p0 before r24p0.
CriticalCVE-2022-28349SUSE bug 1199761cpe:/o:suse:suse-microos:5.0CVE-2022-28350SUSE Linux Enterprise Micro 5.0
Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-after-free situation.
CriticalCVE-2022-28350SUSE bug 1199762cpe:/o:suse:suse-microos:5.0CVE-2022-28388SUSE Linux Enterprise Micro 5.0
usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.
ModerateCVE-2022-28388SUSE bug 1198032cpe:/o:suse:suse-microos:5.0CVE-2022-28389SUSE Linux Enterprise Micro 5.0
mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.
ModerateCVE-2022-28389SUSE bug 1198033SUSE bug 1201657cpe:/o:suse:suse-microos:5.0CVE-2022-28390SUSE Linux Enterprise Micro 5.0
ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
ModerateCVE-2022-28390SUSE bug 1198031SUSE bug 1201517SUSE bug 1207969cpe:/o:suse:suse-microos:5.0CVE-2022-2873SUSE Linux Enterprise Micro 5.0
An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system.
ModerateCVE-2022-2873SUSE bug 1202558cpe:/o:suse:suse-microos:5.0CVE-2022-28738SUSE Linux Enterprise Micro 5.0
A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.
CriticalCVE-2022-28738SUSE bug 1198440cpe:/o:suse:suse-microos:5.0CVE-2022-28739SUSE Linux Enterprise Micro 5.0
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
ModerateCVE-2022-28739SUSE bug 1198441cpe:/o:suse:suse-microos:5.0CVE-2022-28748SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2964. Reason: This candidate is a reservation duplicate of CVE-2022-2964. Notes: All CVE users should reference CVE-2022-2964 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
LowCVE-2022-28748SUSE bug 1196018cpe:/o:suse:suse-microos:5.0CVE-2022-28796SUSE Linux Enterprise Micro 5.0
jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition.
ModerateCVE-2022-28796SUSE bug 1198325SUSE bug 1198594cpe:/o:suse:suse-microos:5.0CVE-2022-28893SUSE Linux Enterprise Micro 5.0
The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.
ModerateCVE-2022-28893SUSE bug 1198330cpe:/o:suse:suse-microos:5.0CVE-2022-2905SUSE Linux Enterprise Micro 5.0
An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.
ModerateCVE-2022-2905SUSE bug 1202860cpe:/o:suse:suse-microos:5.0CVE-2022-29156SUSE Linux Enterprise Micro 5.0
drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release.
ModerateCVE-2022-29156SUSE bug 1198515cpe:/o:suse:suse-microos:5.0CVE-2022-2938SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by default, it could allow an attacker to crash the system or have other memory-corruption side effects.
ModerateCVE-2022-2938SUSE bug 1202623cpe:/o:suse:suse-microos:5.0CVE-2022-29582SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.
ImportantCVE-2022-29582SUSE bug 1198811SUSE bug 1199750cpe:/o:suse:suse-microos:5.0CVE-2022-2959SUSE Linux Enterprise Micro 5.0
A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operations on an object. This flaw allows a local user to crash the system or escalate their privileges on the system.
ImportantCVE-2022-2959SUSE bug 1202681SUSE bug 1202685cpe:/o:suse:suse-microos:5.0CVE-2022-2961SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously triggering the rose_bind() function. This flaw allows a local user to crash or potentially escalate their privileges on the system.
ModerateCVE-2022-2961SUSE bug 1202660cpe:/o:suse:suse-microos:5.0CVE-2022-2978SUSE Linux Enterprise Micro 5.0
A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
ModerateCVE-2022-2978SUSE bug 1202700SUSE bug 1204745cpe:/o:suse:suse-microos:5.0CVE-2022-29968SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private.
LowCVE-2022-29968SUSE bug 1199087cpe:/o:suse:suse-microos:5.0CVE-2022-30115SUSE Linux Enterprise Micro 5.0
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.
ImportantCVE-2022-30115SUSE bug 1199225SUSE bug 1204386SUSE bug 1206308cpe:/o:suse:suse-microos:5.0CVE-2022-3061SUSE Linux Enterprise Micro 5.0
Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by zero error.
ModerateCVE-2022-3061SUSE bug 1202913cpe:/o:suse:suse-microos:5.0CVE-2022-3077SUSE Linux Enterprise Micro 5.0
A buffer overflow vulnerability was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way it handled the I2C_SMBUS_BLOCK_PROC_CALL case (via the ioctl I2C_SMBUS) with malicious input data. This flaw could allow a local user to crash the system.
LowCVE-2022-3077SUSE bug 1203040cpe:/o:suse:suse-microos:5.0CVE-2022-3078SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.16-rc6. There is a lack of check after calling vzalloc() and lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c.
LowCVE-2022-3078SUSE bug 1203041cpe:/o:suse:suse-microos:5.0CVE-2022-3103SUSE Linux Enterprise Micro 5.0
off-by-one in io_uring module.
ImportantCVE-2022-3103SUSE bug 1203801cpe:/o:suse:suse-microos:5.0CVE-2022-3104SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc() and will cause the null pointer dereference.
ModerateCVE-2022-3104SUSE bug 1206396cpe:/o:suse:suse-microos:5.0CVE-2022-3105SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array().
ModerateCVE-2022-3105SUSE bug 1206398cpe:/o:suse:suse-microos:5.0CVE-2022-3106SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc().
ModerateCVE-2022-3106SUSE bug 1206397cpe:/o:suse:suse-microos:5.0CVE-2022-3111SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY, which is registered in wm8350_init_charger().
ModerateCVE-2022-3111SUSE bug 1206394cpe:/o:suse:suse-microos:5.0CVE-2022-3112SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.
ModerateCVE-2022-3112SUSE bug 1206399cpe:/o:suse:suse-microos:5.0CVE-2022-3113SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.
ModerateCVE-2022-3113SUSE bug 1206390cpe:/o:suse:suse-microos:5.0CVE-2022-3114SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_clocks in drivers/clk/imx/clk.c lacks check of the return value of kcalloc() and will cause the null pointer dereference.
ModerateCVE-2022-3114SUSE bug 1206391cpe:/o:suse:suse-microos:5.0CVE-2022-3115SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.
ModerateCVE-2022-3115SUSE bug 1206393cpe:/o:suse:suse-microos:5.0CVE-2022-3170SUSE Linux Enterprise Micro 5.0
An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\0'. A privileged local user could pass a specially crafted name through ioctl() interface and crash the system or potentially escalate their privileges on the system.
ImportantCVE-2022-3170SUSE bug 1203321cpe:/o:suse:suse-microos:5.0CVE-2022-3176SUSE Linux Enterprise Micro 5.0
There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659
ImportantCVE-2022-3176SUSE bug 1203391SUSE bug 1203511cpe:/o:suse:suse-microos:5.0CVE-2022-3202SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux kernel. This could allow a local attacker to crash the system or leak kernel internal information.
ModerateCVE-2022-3202SUSE bug 1203389cpe:/o:suse:suse-microos:5.0CVE-2022-32250SUSE Linux Enterprise Micro 5.0
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.
ImportantCVE-2022-32250SUSE bug 1200015SUSE bug 1200268SUSE bug 1200494SUSE bug 1202992SUSE bug 1202993SUSE bug 1203002cpe:/o:suse:suse-microos:5.0CVE-2022-3238SUSE Linux Enterprise Micro 5.0
A double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneously. This flaw allows a local user to crash or potentially escalate their privileges on the system.
ModerateCVE-2022-3238SUSE bug 1204655cpe:/o:suse:suse-microos:5.0CVE-2022-32981SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers.
ImportantCVE-2022-32981SUSE bug 1200470cpe:/o:suse:suse-microos:5.0CVE-2022-3344SUSE Linux Enterprise Micro 5.0
A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0).
ModerateCVE-2022-3344SUSE bug 1204652cpe:/o:suse:suse-microos:5.0CVE-2022-3435SUSE Linux Enterprise Micro 5.0
A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-210357 was assigned to this vulnerability.
ModerateCVE-2022-3435SUSE bug 1204171cpe:/o:suse:suse-microos:5.0CVE-2022-34494SUSE Linux Enterprise Micro 5.0
rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
ModerateCVE-2022-34494SUSE bug 1201158cpe:/o:suse:suse-microos:5.0CVE-2022-34495SUSE Linux Enterprise Micro 5.0
rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
ModerateCVE-2022-34495SUSE bug 1201159cpe:/o:suse:suse-microos:5.0CVE-2022-34918SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.
ImportantCVE-2022-34918SUSE bug 1201171SUSE bug 1201177SUSE bug 1201222cpe:/o:suse:suse-microos:5.0CVE-2022-3526SUSE Linux Enterprise Micro 5.0
A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the function macvlan_handle_frame of the file drivers/net/macvlan.c of the component skb. The manipulation leads to memory leak. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211024.
ModerateCVE-2022-3526SUSE bug 1204353cpe:/o:suse:suse-microos:5.0CVE-2022-3531SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
LowCVE-2022-3531SUSE bug 1204420cpe:/o:suse:suse-microos:5.0CVE-2022-3532SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
LowCVE-2022-3532SUSE bug 1204418cpe:/o:suse:suse-microos:5.0CVE-2022-3533SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211031.
ModerateCVE-2022-3533SUSE bug 1204393cpe:/o:suse:suse-microos:5.0CVE-2022-3534SUSE Linux Enterprise Micro 5.0
A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211032.
ImportantCVE-2022-3534SUSE bug 1204391cpe:/o:suse:suse-microos:5.0CVE-2022-3535SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
LowCVE-2022-3535SUSE bug 1204417cpe:/o:suse:suse-microos:5.0CVE-2022-3541SUSE Linux Enterprise Micro 5.0
A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file drivers/net/ethernet/sunplus/spl2sw_driver.c of the component BPF. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211041 was assigned to this vulnerability.
ImportantCVE-2022-3541SUSE bug 1204403cpe:/o:suse:suse-microos:5.0CVE-2022-3543SUSE Linux Enterprise Micro 5.0
A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/unix_release_sock of the file net/unix/af_unix.c of the component BPF. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211043.
ModerateCVE-2022-3543SUSE bug 1204401cpe:/o:suse:suse-microos:5.0CVE-2022-3544SUSE Linux Enterprise Micro 5.0
A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected is the function damon_sysfs_add_target of the file mm/damon/sysfs.c of the component Netfilter. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211044.
ModerateCVE-2022-3544SUSE bug 1204404cpe:/o:suse:suse-microos:5.0CVE-2022-3577SUSE Linux Enterprise Micro 5.0
An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver. This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in bigben_probe of drivers/hid/hid-bigbenff.c. The reason is incorrect assumption - bigben devices all have inputs. However, malicious devices can break this assumption, leaking to out-of-bound write.
ModerateCVE-2022-3577SUSE bug 1204470SUSE bug 1204486cpe:/o:suse:suse-microos:5.0CVE-2022-3595SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux Kernel. It has been rated as problematic. Affected by this issue is the function sess_free_buffer of the file fs/cifs/sess.c of the component CIFS Handler. The manipulation leads to double free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211364.
ModerateCVE-2022-3595SUSE bug 1204476cpe:/o:suse:suse-microos:5.0CVE-2022-3606SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier VDB-211749 was assigned to this vulnerability.
ModerateCVE-2022-3606SUSE bug 1204502cpe:/o:suse:suse-microos:5.0CVE-2022-36123SUSE Linux Enterprise Micro 5.0
The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges.
ModerateCVE-2022-36123SUSE bug 1202010SUSE bug 1202583cpe:/o:suse:suse-microos:5.0CVE-2022-3619SUSE Linux Enterprise Micro 5.0
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the identifier assigned to this vulnerability.
ModerateCVE-2022-3619SUSE bug 1204569cpe:/o:suse:suse-microos:5.0CVE-2022-3623SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211921 was assigned to this vulnerability.
ModerateCVE-2022-3623SUSE bug 1204575cpe:/o:suse:suse-microos:5.0CVE-2022-3624SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux Kernel and classified as problematic. Affected by this issue is the function rlb_arp_xmit of the file drivers/net/bonding/bond_alb.c of the component IPsec. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211928.
LowCVE-2022-3624SUSE bug 1204639cpe:/o:suse:suse-microos:5.0CVE-2022-3625SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211929 was assigned to this vulnerability.
ModerateCVE-2022-3625SUSE bug 1204637cpe:/o:suse:suse-microos:5.0CVE-2022-3630SUSE Linux Enterprise Micro 5.0
A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects some unknown processing of the file fs/fscache/cookie.c of the component IPsec. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211931.
ModerateCVE-2022-3630SUSE bug 1204634cpe:/o:suse:suse-microos:5.0CVE-2022-3633SUSE Linux Enterprise Micro 5.0
A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939_session_destroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211932.
LowCVE-2022-3633SUSE bug 1204650cpe:/o:suse:suse-microos:5.0CVE-2022-3636SUSE Linux Enterprise Micro 5.0
A vulnerability, which was classified as critical, was found in Linux Kernel. This affects the function __mtk_ppe_check_skb of the file drivers/net/ethernet/mediatek/mtk_ppe.c of the component Ethernet Handler. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211935.
ModerateCVE-2022-3636SUSE bug 1204638cpe:/o:suse:suse-microos:5.0CVE-2022-3640SUSE Linux Enterprise Micro 5.0
A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944.
ImportantCVE-2022-3640SUSE bug 1204619SUSE bug 1204624SUSE bug 1209225cpe:/o:suse:suse-microos:5.0CVE-2022-3642SUSE Linux Enterprise Micro 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
ModerateCVE-2022-3642SUSE bug 1204626cpe:/o:suse:suse-microos:5.0CVE-2022-3707SUSE Linux Enterprise Micro 5.0
A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could allow a local user to crash the system.
ModerateCVE-2022-3707SUSE bug 1204780cpe:/o:suse:suse-microos:5.0CVE-2022-3910SUSE Linux Enterprise Micro 5.0
Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation. When io_msg_ring was invoked with a fixed file, it called io_fput_file() which improperly decreased its reference count (leading to Use-After-Free and Local Privilege Escalation). Fixed files are permanently registered to the ring, and should not be put separately. We recommend upgrading past commit https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679
ImportantCVE-2022-3910SUSE bug 1205670cpe:/o:suse:suse-microos:5.0CVE-2022-39189SUSE Linux Enterprise Micro 5.0
An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations.
ModerateCVE-2022-39189SUSE bug 1203066SUSE bug 1203067SUSE bug 1209225cpe:/o:suse:suse-microos:5.0CVE-2022-39190SUSE Linux Enterprise Micro 5.0
An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.
ModerateCVE-2022-39190SUSE bug 1203117cpe:/o:suse:suse-microos:5.0CVE-2022-3977SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system.
ModerateCVE-2022-3977SUSE bug 1207048cpe:/o:suse:suse-microos:5.0CVE-2022-39842SUSE Linux Enterprise Micro 5.0
** DISPUTED ** An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen.
ImportantCVE-2022-39842SUSE bug 1203124cpe:/o:suse:suse-microos:5.0CVE-2022-40476SUSE Linux Enterprise Micro 5.0
A null pointer dereference issue was discovered in fs/io_uring.c in the Linux kernel before 5.15.62. A local user could use this flaw to crash the system or potentially cause a denial of service.
ModerateCVE-2022-40476SUSE bug 1203435cpe:/o:suse:suse-microos:5.0CVE-2022-40540SUSE Linux Enterprise Micro 5.0
Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel.
ModerateCVE-2022-40540SUSE bug 1209597cpe:/o:suse:suse-microos:5.0CVE-2022-41222SUSE Linux Enterprise Micro 5.0
mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.
ModerateCVE-2022-41222SUSE bug 1203622SUSE bug 1203624SUSE bug 1209225SUSE bug 1209476cpe:/o:suse:suse-microos:5.0CVE-2022-4127SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc. A local user could use this flaw to potentially crash the system causing a denial of service.
ModerateCVE-2022-4127SUSE bug 1205703cpe:/o:suse:suse-microos:5.0CVE-2022-4128SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could use this flaw to potentially crash the system causing a denial of service.
ModerateCVE-2022-4128SUSE bug 1205704cpe:/o:suse:suse-microos:5.0CVE-2022-4139SUSE Linux Enterprise Micro 5.0
An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system.
ModerateCVE-2022-4139SUSE bug 1205700SUSE bug 1205815SUSE bug 1209225cpe:/o:suse:suse-microos:5.0CVE-2022-41674SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.
ImportantCVE-2022-41674SUSE bug 1203770SUSE bug 1203994SUSE bug 1209225cpe:/o:suse:suse-microos:5.0CVE-2022-41849SUSE Linux Enterprise Micro 5.0
drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect.
ModerateCVE-2022-41849SUSE bug 1203992cpe:/o:suse:suse-microos:5.0CVE-2022-42432SUSE Linux Enterprise Micro 5.0
This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the nft_osf_eval function. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-18540.
ModerateCVE-2022-42432SUSE bug 1204614cpe:/o:suse:suse-microos:5.0CVE-2022-4269SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.
ModerateCVE-2022-4269SUSE bug 1206024cpe:/o:suse:suse-microos:5.0CVE-2022-42719SUSE Linux Enterprise Micro 5.0
A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code.
ImportantCVE-2022-42719SUSE bug 1204051SUSE bug 1204292SUSE bug 1209225cpe:/o:suse:suse-microos:5.0CVE-2022-42720SUSE Linux Enterprise Micro 5.0
Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code.
ImportantCVE-2022-42720SUSE bug 1204059SUSE bug 1204291SUSE bug 1209225cpe:/o:suse:suse-microos:5.0CVE-2022-42721SUSE Linux Enterprise Micro 5.0
A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code.
ImportantCVE-2022-42721SUSE bug 1204060SUSE bug 1204290SUSE bug 1209225cpe:/o:suse:suse-microos:5.0CVE-2022-42722SUSE Linux Enterprise Micro 5.0
In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices.
ImportantCVE-2022-42722SUSE bug 1204125SUSE bug 1204289SUSE bug 1209225cpe:/o:suse:suse-microos:5.0CVE-2022-42916SUSE Linux Enterprise Micro 5.0
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.
ImportantCVE-2022-42916SUSE bug 1204386SUSE bug 1206308cpe:/o:suse:suse-microos:5.0CVE-2022-43551SUSE Linux Enterprise Micro 5.0
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.
ImportantCVE-2022-43551SUSE bug 1206308cpe:/o:suse:suse-microos:5.0CVE-2022-4379SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial
ImportantCVE-2022-4379SUSE bug 1206209SUSE bug 1206373cpe:/o:suse:suse-microos:5.0CVE-2022-4382SUSE Linux Enterprise Micro 5.0
A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device that is running the gadgetfs side.
ImportantCVE-2022-4382SUSE bug 1206258SUSE bug 1206363cpe:/o:suse:suse-microos:5.0CVE-2022-44032SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4000_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cmm_open() and cm4000_detach().
ModerateCVE-2022-44032SUSE bug 1204894SUSE bug 1212290cpe:/o:suse:suse-microos:5.0CVE-2022-44033SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().
ModerateCVE-2022-44033SUSE bug 1204922SUSE bug 1212306cpe:/o:suse:suse-microos:5.0CVE-2022-44034SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/scr24x_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between scr24x_open() and scr24x_remove().
ModerateCVE-2022-44034SUSE bug 1204901cpe:/o:suse:suse-microos:5.0CVE-2022-45869SUSE Linux Enterprise Micro 5.0
A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crash or host OS memory corruption) when nested virtualisation and the TDP MMU are enabled.
ModerateCVE-2022-45869SUSE bug 1205882cpe:/o:suse:suse-microos:5.0CVE-2022-45888SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device.
LowCVE-2022-45888SUSE bug 1205764cpe:/o:suse:suse-microos:5.0CVE-2022-46781SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU memory processing operations to access a limited amount outside of buffer bounds. This affects Valhall r29p0 through r41p0 before r42p0 and Avalon r41p0 before r42p0.
LowCVE-2022-46781SUSE bug 1210235cpe:/o:suse:suse-microos:5.0CVE-2022-4696SUSE Linux Enterprise Micro 5.0
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
ImportantCVE-2022-4696SUSE bug 1207118cpe:/o:suse:suse-microos:5.0CVE-2022-4744SUSE Linux Enterprise Micro 5.0
A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system.
ImportantCVE-2022-4744SUSE bug 1209635SUSE bug 1209672SUSE bug 1211833cpe:/o:suse:suse-microos:5.0CVE-2022-47518SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.
ModerateCVE-2022-47518SUSE bug 1206511cpe:/o:suse:suse-microos:5.0CVE-2022-47519SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.
ImportantCVE-2022-47519SUSE bug 1206512cpe:/o:suse:suse-microos:5.0CVE-2022-47520SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.
ImportantCVE-2022-47520SUSE bug 1206515SUSE bug 1207823cpe:/o:suse:suse-microos:5.0CVE-2022-47521SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.
ModerateCVE-2022-47521SUSE bug 1206516cpe:/o:suse:suse-microos:5.0CVE-2022-47938SUSE Linux Enterprise Micro 5.0
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT.
ModerateCVE-2022-47938SUSE bug 1206658cpe:/o:suse:suse-microos:5.0CVE-2022-47939SUSE Linux Enterprise Micro 5.0
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c has a use-after-free and OOPS for SMB2_TREE_DISCONNECT.
CriticalCVE-2022-47939SUSE bug 1206654cpe:/o:suse:suse-microos:5.0CVE-2022-47940SUSE Linux Enterprise Micro 5.0
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in smb2_write.
CriticalCVE-2022-47940SUSE bug 1206679cpe:/o:suse:suse-microos:5.0CVE-2022-47941SUSE Linux Enterprise Micro 5.0
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_handle_negotiate error conditions, aka a memory leak.
ModerateCVE-2022-47941SUSE bug 1206656cpe:/o:suse:suse-microos:5.0CVE-2022-47942SUSE Linux Enterprise Micro 5.0
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap-based buffer overflow in set_ntacl_dacl, related to use of SMB2_QUERY_INFO_HE after a malformed SMB2_SET_INFO_HE command.
ImportantCVE-2022-47942SUSE bug 1206657cpe:/o:suse:suse-microos:5.0CVE-2022-47943SUSE Linux Enterprise Micro 5.0
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an out-of-bounds read and OOPS for SMB2_WRITE, when there is a large length in the zero DataOffset case.
CriticalCVE-2022-47943SUSE bug 1206655cpe:/o:suse:suse-microos:5.0CVE-2022-47946SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can be skipped. An attack can occur in some situations by forking a process and then quickly terminating it. NOTE: later kernel versions, such as the 5.15 longterm series, substantially changed the implementation of io_sqpoll_wait_sq.
ModerateCVE-2022-47946SUSE bug 1206714cpe:/o:suse:suse-microos:5.0CVE-2022-4842SUSE Linux Enterprise Micro 5.0
A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system.
ModerateCVE-2022-4842SUSE bug 1206749cpe:/o:suse:suse-microos:5.0CVE-2022-48423SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur.
ModerateCVE-2022-48423SUSE bug 1209479cpe:/o:suse:suse-microos:5.0CVE-2022-48424SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An unhandled page fault may occur.
ModerateCVE-2022-48424SUSE bug 1209475cpe:/o:suse:suse-microos:5.0CVE-2022-48425SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs.
ModerateCVE-2022-48425SUSE bug 1209501cpe:/o:suse:suse-microos:5.0CVE-2022-48502SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c.
ModerateCVE-2022-48502SUSE bug 1211887cpe:/o:suse:suse-microos:5.0CVE-2023-0030SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the Linux kernel’s nouveau driver in how a user triggers a memory overflow that causes the nvkm_vma_tail function to fail. This flaw allows a local user to crash or potentially escalate their privileges on the system.
ModerateCVE-2023-0030SUSE bug 1206777cpe:/o:suse:suse-microos:5.0CVE-2023-0122SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4.
ModerateCVE-2023-0122SUSE bug 1207050cpe:/o:suse:suse-microos:5.0CVE-2023-0179SUSE Linux Enterprise Micro 5.0
A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.
ImportantCVE-2023-0179SUSE bug 1207034SUSE bug 1207139SUSE bug 1215208cpe:/o:suse:suse-microos:5.0CVE-2023-0210SUSE Linux Enterprise Micro 5.0
A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems.
ImportantCVE-2023-0210SUSE bug 1206707cpe:/o:suse:suse-microos:5.0CVE-2023-0266SUSE Linux Enterprise Micro 5.0
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel.?SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit?56b88b50565cd8b946a2d00b0c83927b7ebb055e
ImportantCVE-2023-0266SUSE bug 1207134SUSE bug 1207190SUSE bug 1214128cpe:/o:suse:suse-microos:5.0CVE-2023-0386SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
ImportantCVE-2023-0386SUSE bug 1209615SUSE bug 1210499cpe:/o:suse:suse-microos:5.0CVE-2023-0458SUSE Linux Enterprise Micro 5.0
A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or commit?739790605705ddcf18f21782b9c99ad7d53a8c11
ModerateCVE-2023-0458SUSE bug 1210905cpe:/o:suse:suse-microos:5.0CVE-2023-0461SUSE Linux Enterprise Micro 5.0
There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS?or CONFIG_XFRM_ESPINTCP?has to be configured, but the operation does not require any privilege.
There is a use-after-free bug of icsk_ulp_data?of a struct inet_connection_sock.
When CONFIG_TLS?is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.
The setsockopt?TCP_ULP?operation does not require any privilege.
We recommend upgrading past commit?2c02d41d71f90a5168391b6a5f2954112ba2307c
ImportantCVE-2023-0461SUSE bug 1208787SUSE bug 1208911SUSE bug 1211833cpe:/o:suse:suse-microos:5.0CVE-2023-0468SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Kernel due to a race condition of poll_refs. This flaw may cause a NULL pointer dereference.
ModerateCVE-2023-0468SUSE bug 1207511cpe:/o:suse:suse-microos:5.0CVE-2023-0469SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Linux Kernel during call cleanup. This flaw may lead to a denial of service.
ModerateCVE-2023-0469SUSE bug 1207521cpe:/o:suse:suse-microos:5.0CVE-2023-0615SUSE Linux Enterprise Micro 5.0
A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled.
ModerateCVE-2023-0615SUSE bug 1207844cpe:/o:suse:suse-microos:5.0CVE-2023-1032SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2023-1032SUSE bug 1209240cpe:/o:suse:suse-microos:5.0CVE-2023-1075SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field that overlaps with rec->tx_ready.
LowCVE-2023-1075SUSE bug 1208598cpe:/o:suse:suse-microos:5.0CVE-2023-1078SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption.
ImportantCVE-2023-1078SUSE bug 1208601SUSE bug 1208603cpe:/o:suse:suse-microos:5.0CVE-2023-1192SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2023-1192SUSE bug 1208995cpe:/o:suse:suse-microos:5.0CVE-2023-1193SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2023-1193SUSE bug 1208972cpe:/o:suse:suse-microos:5.0CVE-2023-1194SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ImportantCVE-2023-1194SUSE bug 1208968cpe:/o:suse:suse-microos:5.0CVE-2023-1195SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in reconn_set_ipaddr_from_hostname in fs/cifs/connect.c in the Linux kernel. The issue occurs when it forgets to set the free pointer server->hostname to NULL, leading to an invalid pointer request.
LowCVE-2023-1195SUSE bug 1208971cpe:/o:suse:suse-microos:5.0CVE-2023-1252SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 ("ovl: fix use after free in struct ovl_aio_req") not applied yet, the kernel could be affected.
ModerateCVE-2023-1252SUSE bug 1209045cpe:/o:suse:suse-microos:5.0CVE-2023-1295SUSE Linux Enterprise Micro 5.0
A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.
ImportantCVE-2023-1295SUSE bug 1212836cpe:/o:suse:suse-microos:5.0CVE-2023-1382SUSE Linux Enterprise Micro 5.0
A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel.
ModerateCVE-2023-1382SUSE bug 1209288cpe:/o:suse:suse-microos:5.0CVE-2023-1476SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2023-1476SUSE bug 1209476cpe:/o:suse:suse-microos:5.0CVE-2023-1582SUSE Linux Enterprise Micro 5.0
A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue may allow a local attacker with user privilege to cause a denial of service.
ModerateCVE-2023-1582SUSE bug 1209636cpe:/o:suse:suse-microos:5.0CVE-2023-1583SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference was found in io_file_bitmap_get in io_uring/filetable.c in the io_uring sub-component in the Linux Kernel. When fixed files are unregistered, some context information (file_alloc_{start,end} and alloc_hint) is not cleared. A subsequent request that has auto index selection enabled via IORING_FILE_INDEX_ALLOC can cause a NULL pointer dereference. An unprivileged user can use the flaw to cause a system crash.
ModerateCVE-2023-1583SUSE bug 1209637cpe:/o:suse:suse-microos:5.0CVE-2023-1652SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem.
ModerateCVE-2023-1652SUSE bug 1209788SUSE bug 1209797cpe:/o:suse:suse-microos:5.0CVE-2023-1829SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation.?The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure.?A local attacker user can use this vulnerability to elevate its privileges to root.
We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28.
ImportantCVE-2023-1829SUSE bug 1210335SUSE bug 1210619cpe:/o:suse:suse-microos:5.0CVE-2023-1872SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation.
The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered.
We recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8.
ImportantCVE-2023-1872SUSE bug 1210414SUSE bug 1210417cpe:/o:suse:suse-microos:5.0CVE-2023-2002SUSE Linux Enterprise Micro 5.0
A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication.
ModerateCVE-2023-2002SUSE bug 1210533SUSE bug 1210566cpe:/o:suse:suse-microos:5.0CVE-2023-2006SUSE Linux Enterprise Micro 5.0
A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.
ImportantCVE-2023-2006SUSE bug 1210447SUSE bug 1210457cpe:/o:suse:suse-microos:5.0CVE-2023-2008SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
ModerateCVE-2023-2008SUSE bug 1210453cpe:/o:suse:suse-microos:5.0CVE-2023-2019SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system.
ModerateCVE-2023-2019SUSE bug 1210454cpe:/o:suse:suse-microos:5.0CVE-2023-20941SUSE Linux Enterprise Micro 5.0
In acc_ctrlrequest_composite of f_accessory.c, there is a possible out of bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-264029575References: Upstream kernel
ModerateCVE-2023-20941SUSE bug 1210676cpe:/o:suse:suse-microos:5.0CVE-2023-21102SUSE Linux Enterprise Micro 5.0
In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-260821414References: Upstream kernel
ImportantCVE-2023-21102SUSE bug 1212155SUSE bug 1212346cpe:/o:suse:suse-microos:5.0CVE-2023-21106SUSE Linux Enterprise Micro 5.0
In adreno_set_param of adreno_gpu.c, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-265016072References: Upstream kernel
ImportantCVE-2023-21106SUSE bug 1211654SUSE bug 1211655cpe:/o:suse:suse-microos:5.0CVE-2023-21264SUSE Linux Enterprise Micro 5.0
In multiple functions of mem_protect.c, there is a possible way to access hypervisor memory due to a memory access check in the wrong place. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
ModerateCVE-2023-21264SUSE bug 1214289cpe:/o:suse:suse-microos:5.0CVE-2023-21400SUSE Linux Enterprise Micro 5.0
In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.
ModerateCVE-2023-21400SUSE bug 1213272cpe:/o:suse:suse-microos:5.0CVE-2023-2156SUSE Linux Enterprise Micro 5.0
A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system.
ImportantCVE-2023-2156SUSE bug 1211131SUSE bug 1211395cpe:/o:suse:suse-microos:5.0CVE-2023-2163SUSE Linux Enterprise Micro 5.0
Incorrect verifier pruning?in BPF in Linux Kernel?>=5.4?leads to unsafe
code paths being incorrectly marked as safe, resulting in?arbitrary read/write in
kernel memory, lateral privilege escalation, and container escape.
ImportantCVE-2023-2163SUSE bug 1215518SUSE bug 1215519cpe:/o:suse:suse-microos:5.0CVE-2023-21636SUSE Linux Enterprise Micro 5.0
Memory Corruption due to improper validation of array index in Linux while updating adn record.
ModerateCVE-2023-21636SUSE bug 1215069cpe:/o:suse:suse-microos:5.0CVE-2023-2166SUSE Linux Enterprise Micro 5.0
A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service.
ModerateCVE-2023-2166SUSE bug 1210627cpe:/o:suse:suse-microos:5.0CVE-2023-2177SUSE Linux Enterprise Micro 5.0
A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A local user could use this flaw to crash the system or potentially cause a denial of service.
ModerateCVE-2023-2177SUSE bug 1210643cpe:/o:suse:suse-microos:5.0CVE-2023-22024SUSE Linux Enterprise Micro 5.0
In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS_CONN_RESET and RDS6_CONN_RESET, that are not re-entrant. A malicious local user with CAP_NET_ADMIN can use this to crash the kernel. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
ModerateCVE-2023-22024SUSE bug 1215615cpe:/o:suse:suse-microos:5.0CVE-2023-2235SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation.
The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but?remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability.
We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2.
ImportantCVE-2023-2235SUSE bug 1210986SUSE bug 1210987cpe:/o:suse:suse-microos:5.0CVE-2023-2236SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation.
Both?io_install_fixed_file?and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability.
We recommend upgrading past commit 9d94c04c0db024922e886c9fd429659f22f48ea4.
ImportantCVE-2023-2236SUSE bug 1210990SUSE bug 1210991cpe:/o:suse:suse-microos:5.0CVE-2023-22995SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls.
LowCVE-2023-22995SUSE bug 1208741cpe:/o:suse:suse-microos:5.0CVE-2023-22996SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device.
ModerateCVE-2023-22996SUSE bug 1208781cpe:/o:suse:suse-microos:5.0CVE-2023-22997SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module_get_next_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
LowCVE-2023-22997SUSE bug 1208782cpe:/o:suse:suse-microos:5.0CVE-2023-22998SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
ModerateCVE-2023-22998SUSE bug 1208776cpe:/o:suse:suse-microos:5.0CVE-2023-22999SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.16.3, drivers/usb/dwc3/dwc3-qcom.c misinterprets the dwc3_qcom_create_urs_usb_platdev return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
ModerateCVE-2023-22999SUSE bug 1208785cpe:/o:suse:suse-microos:5.0CVE-2023-23000SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used.
LowCVE-2023-23000SUSE bug 1208816cpe:/o:suse:suse-microos:5.0CVE-2023-23001SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
LowCVE-2023-23001SUSE bug 1208829cpe:/o:suse:suse-microos:5.0CVE-2023-23002SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
ModerateCVE-2023-23002SUSE bug 1208840cpe:/o:suse:suse-microos:5.0CVE-2023-23003SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value.
LowCVE-2023-23003SUSE bug 1208842cpe:/o:suse:suse-microos:5.0CVE-2023-23004SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
LowCVE-2023-23004SUSE bug 1208843cpe:/o:suse:suse-microos:5.0CVE-2023-23005SUSE Linux Enterprise Micro 5.0
** DISPUTED ** In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actually an error pointer). NOTE: this is disputed by third parties because there are no realistic cases in which a user can cause the alloc_memory_type error case to be reached.
LowCVE-2023-23005SUSE bug 1208844cpe:/o:suse:suse-microos:5.0CVE-2023-23006SUSE Linux Enterprise Micro 5.0
In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
ModerateCVE-2023-23006SUSE bug 1208845cpe:/o:suse:suse-microos:5.0CVE-2023-23039SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().
ModerateCVE-2023-23039SUSE bug 1208641cpe:/o:suse:suse-microos:5.0CVE-2023-23586SUSE Linux Enterprise Micro 5.0
Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process. timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring's io_worker threads, thus it is possible to insert a time namespace's vvar page to process's memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process' memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit 788d0824269bef539fe31a785b1517882eafed93 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring
ModerateCVE-2023-23586SUSE bug 1208474cpe:/o:suse:suse-microos:5.0CVE-2023-2430SUSE Linux Enterprise Micro 5.0
A vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c in Linux Kernel. This flaw allows a local attacker with user privilege to trigger a Denial of Service threat.
ModerateCVE-2023-2430SUSE bug 1211014cpe:/o:suse:suse-microos:5.0CVE-2023-25012SUSE Linux Enterprise Micro 5.0
The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long.
ModerateCVE-2023-25012SUSE bug 1207560SUSE bug 1207846cpe:/o:suse:suse-microos:5.0CVE-2023-2593SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2023-2593SUSE bug 1211527cpe:/o:suse:suse-microos:5.0CVE-2023-2598SUSE Linux Enterprise Micro 5.0
A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation.
ImportantCVE-2023-2598SUSE bug 1211046cpe:/o:suse:suse-microos:5.0CVE-2023-26083SUSE Linux Enterprise Micro 5.0
Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.
ModerateCVE-2023-26083SUSE bug 1210236cpe:/o:suse:suse-microos:5.0CVE-2023-2612SUSE Linux Enterprise Micro 5.0
Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).
ModerateCVE-2023-2612SUSE bug 1211902cpe:/o:suse:suse-microos:5.0CVE-2023-26242SUSE Linux Enterprise Micro 5.0
afu_mmio_region_get_by_offset in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overflow.
ImportantCVE-2023-26242SUSE bug 1208518cpe:/o:suse:suse-microos:5.0CVE-2023-26544SUSE Linux Enterprise Micro 5.0
In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size.
ModerateCVE-2023-26544SUSE bug 1208697cpe:/o:suse:suse-microos:5.0CVE-2023-26605SUSE Linux Enterprise Micro 5.0
In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attached in fs/fs-writeback.c, related to __list_del_entry_valid.
ImportantCVE-2023-26605SUSE bug 1208699cpe:/o:suse:suse-microos:5.0CVE-2023-26606SUSE Linux Enterprise Micro 5.0
In the Linux kernel 6.0.8, there is a use-after-free in ntfs_trim_fs in fs/ntfs3/bitmap.c.
ModerateCVE-2023-26606SUSE bug 1208694cpe:/o:suse:suse-microos:5.0CVE-2023-26607SUSE Linux Enterprise Micro 5.0
In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
ImportantCVE-2023-26607SUSE bug 1208703cpe:/o:suse:suse-microos:5.0CVE-2023-28327SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service.
ModerateCVE-2023-28327SUSE bug 1209290cpe:/o:suse:suse-microos:5.0CVE-2023-28410SUSE Linux Enterprise Micro 5.0
Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable escalation of privilege via local access.
ImportantCVE-2023-28410SUSE bug 1211263SUSE bug 1211819cpe:/o:suse:suse-microos:5.0CVE-2023-28866SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not.
ModerateCVE-2023-28866SUSE bug 1209780cpe:/o:suse:suse-microos:5.0CVE-2023-2898SUSE Linux Enterprise Micro 5.0
There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.
ModerateCVE-2023-2898SUSE bug 1211742cpe:/o:suse:suse-microos:5.0CVE-2023-3022SUSE Linux Enterprise Micro 5.0
A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6_rule_lookup, sometimes holding rt6_info and other times fib6_info. This was not accounted for in other parts of the code where rt6_info was expected unconditionally, potentially leading to a kernel panic in fib6_rule_suppress.
ModerateCVE-2023-3022SUSE bug 1211906cpe:/o:suse:suse-microos:5.0CVE-2023-3106SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Netlink socket receives the message(sendmsg) for the XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP flag is set and can cause a denial of service or possibly another unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is unlikely.
ModerateCVE-2023-3106SUSE bug 1213251cpe:/o:suse:suse-microos:5.0CVE-2023-31081SUSE Linux Enterprise Micro 5.0
An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_bridge.c in the Linux kernel 6.2. There is a NULL pointer dereference in vidtv_mux_stop_thread. In vidtv_stop_streaming, after dvb->mux=NULL occurs, it executes vidtv_mux_stop_thread(dvb->mux).
ModerateCVE-2023-31081SUSE bug 1210782cpe:/o:suse:suse-microos:5.0CVE-2023-31248SUSE Linux Enterprise Micro 5.0
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
ImportantCVE-2023-31248SUSE bug 1213061SUSE bug 1213064cpe:/o:suse:suse-microos:5.0CVE-2023-3212SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
ModerateCVE-2023-3212SUSE bug 1212265cpe:/o:suse:suse-microos:5.0CVE-2023-3220SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference.
ModerateCVE-2023-3220SUSE bug 1212556cpe:/o:suse:suse-microos:5.0CVE-2023-32233SUSE Linux Enterprise Micro 5.0
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.
ImportantCVE-2023-32233SUSE bug 1211043SUSE bug 1211187cpe:/o:suse:suse-microos:5.0CVE-2023-32246SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2023-32246SUSE bug 1211528cpe:/o:suse:suse-microos:5.0CVE-2023-32247SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
ImportantCVE-2023-32247SUSE bug 1211529cpe:/o:suse:suse-microos:5.0CVE-2023-32248SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
ImportantCVE-2023-32248SUSE bug 1211530cpe:/o:suse:suse-microos:5.0CVE-2023-32249SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2023-32249SUSE bug 1211531cpe:/o:suse:suse-microos:5.0CVE-2023-32250SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.
ImportantCVE-2023-32250SUSE bug 1211532cpe:/o:suse:suse-microos:5.0CVE-2023-32251SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
LowCVE-2023-32251SUSE bug 1211533cpe:/o:suse:suse-microos:5.0CVE-2023-32252SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
ImportantCVE-2023-32252SUSE bug 1211534cpe:/o:suse:suse-microos:5.0CVE-2023-32253SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2023-32253SUSE bug 1211535cpe:/o:suse:suse-microos:5.0CVE-2023-32254SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.
CriticalCVE-2023-32254SUSE bug 1211536cpe:/o:suse:suse-microos:5.0CVE-2023-32255SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2023-32255SUSE bug 1211537cpe:/o:suse:suse-microos:5.0CVE-2023-32256SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ImportantCVE-2023-32256SUSE bug 1211538cpe:/o:suse:suse-microos:5.0CVE-2023-32257SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.
ImportantCVE-2023-32257SUSE bug 1211539cpe:/o:suse:suse-microos:5.0CVE-2023-32258SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.
ImportantCVE-2023-32258SUSE bug 1211540cpe:/o:suse:suse-microos:5.0CVE-2023-32629SUSE Linux Enterprise Micro 5.0
Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu kernels
ImportantCVE-2023-32629SUSE bug 1213685SUSE bug 1213707cpe:/o:suse:suse-microos:5.0CVE-2023-3269SUSE Linux Enterprise Micro 5.0
A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges.
ImportantCVE-2023-3269SUSE bug 1212395SUSE bug 1213760cpe:/o:suse:suse-microos:5.0CVE-2023-3312SUSE Linux Enterprise Micro 5.0
A vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in cpufreq subsystem in the Linux Kernel. This flaw, during device unbind will lead to double release problem leading to denial of service.
ModerateCVE-2023-3312SUSE bug 1212536cpe:/o:suse:suse-microos:5.0CVE-2023-33250SUSE Linux Enterprise Micro 5.0
The Linux kernel 6.3 has a use-after-free in iopt_unmap_iova_range in drivers/iommu/iommufd/io_pagetable.c.
ModerateCVE-2023-33250SUSE bug 1211597cpe:/o:suse:suse-microos:5.0CVE-2023-33288SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition.
ModerateCVE-2023-33288SUSE bug 1211590cpe:/o:suse:suse-microos:5.0CVE-2023-3355SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the Linux kernel's drivers/gpu/drm/msm/msm_gem_submit.c code in the submit_lookup_cmds function, which fails because it lacks a check of the return value of kmalloc(). This issue allows a local user to crash the system.
LowCVE-2023-3355SUSE bug 1212778cpe:/o:suse:suse-microos:5.0CVE-2023-3357SUSE Linux Enterprise Micro 5.0
A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system.
ModerateCVE-2023-3357SUSE bug 1212605cpe:/o:suse:suse-microos:5.0CVE-2023-3359SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the return value of kzalloc() can cause the NULL Pointer Dereference.
ModerateCVE-2023-3359SUSE bug 1212608cpe:/o:suse:suse-microos:5.0CVE-2023-3389SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation.
Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer.
We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and?0e388fce7aec40992eadee654193cad345d62663 for 5.15 stable).
ModerateCVE-2023-3389SUSE bug 1212838cpe:/o:suse:suse-microos:5.0CVE-2023-33951SUSE Linux Enterprise Micro 5.0
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel.
ModerateCVE-2023-33951SUSE bug 1211593cpe:/o:suse:suse-microos:5.0CVE-2023-33952SUSE Linux Enterprise Micro 5.0
A double-free vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of vmw_buffer_object objects. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. This flaw allows a local privileged user to escalate privileges and execute code in the context of the kernel.
ImportantCVE-2023-33952SUSE bug 1211595SUSE bug 1212348cpe:/o:suse:suse-microos:5.0CVE-2023-34256SUSE Linux Enterprise Micro 5.0
** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.
LowCVE-2023-34256SUSE bug 1211895cpe:/o:suse:suse-microos:5.0CVE-2023-3439SUSE Linux Enterprise Micro 5.0
A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service.
ModerateCVE-2023-3439SUSE bug 1212845cpe:/o:suse:suse-microos:5.0CVE-2023-35788SUSE Linux Enterprise Micro 5.0
An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation.
ImportantCVE-2023-35788SUSE bug 1212504SUSE bug 1212509cpe:/o:suse:suse-microos:5.0CVE-2023-35823SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c.
ModerateCVE-2023-35823SUSE bug 1212494cpe:/o:suse:suse-microos:5.0CVE-2023-35826SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in cedrus_remove in drivers/staging/media/sunxi/cedrus/cedrus.c.
ModerateCVE-2023-35826SUSE bug 1212505cpe:/o:suse:suse-microos:5.0CVE-2023-35827SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.
ModerateCVE-2023-35827SUSE bug 1212514cpe:/o:suse:suse-microos:5.0CVE-2023-35828SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c.
ModerateCVE-2023-35828SUSE bug 1212513cpe:/o:suse:suse-microos:5.0CVE-2023-35829SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c.
ModerateCVE-2023-35829SUSE bug 1212495cpe:/o:suse:suse-microos:5.0CVE-2023-3610SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered.
We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795.
ImportantCVE-2023-3610SUSE bug 1213580SUSE bug 1213584cpe:/o:suse:suse-microos:5.0CVE-2023-37453SUSE Linux Enterprise Micro 5.0
An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c.
ModerateCVE-2023-37453SUSE bug 1213123cpe:/o:suse:suse-microos:5.0CVE-2023-3773SUSE Linux Enterprise Micro 5.0
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.
ModerateCVE-2023-3773SUSE bug 1213667cpe:/o:suse:suse-microos:5.0CVE-2023-3777SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances.
We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.
ImportantCVE-2023-3777SUSE bug 1215095SUSE bug 1215097cpe:/o:suse:suse-microos:5.0CVE-2023-38409SUSE Linux Enterprise Micro 5.0
An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
LowCVE-2023-38409SUSE bug 1213417cpe:/o:suse:suse-microos:5.0CVE-2023-38426SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length.
CriticalCVE-2023-38426SUSE bug 1213421cpe:/o:suse:suse-microos:5.0CVE-2023-38427SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemble_neg_contexts.
CriticalCVE-2023-38427SUSE bug 1213422cpe:/o:suse:suse-microos:5.0CVE-2023-38428SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read.
CriticalCVE-2023-38428SUSE bug 1213423cpe:/o:suse:suse-microos:5.0CVE-2023-38429SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbd_smb2_check_message) that may lead to out-of-bounds access.
CriticalCVE-2023-38429SUSE bug 1213424cpe:/o:suse:suse-microos:5.0CVE-2023-38430SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read.
CriticalCVE-2023-38430SUSE bug 1213425cpe:/o:suse:suse-microos:5.0CVE-2023-38431SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, leading to an out-of-bounds read.
CriticalCVE-2023-38431SUSE bug 1213426cpe:/o:suse:suse-microos:5.0CVE-2023-38432SUSE Linux Enterprise Micro 5.0
An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read.
CriticalCVE-2023-38432SUSE bug 1213427cpe:/o:suse:suse-microos:5.0CVE-2023-3865SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ImportantCVE-2023-3865SUSE bug 1213813cpe:/o:suse:suse-microos:5.0CVE-2023-3866SUSE Linux Enterprise Micro 5.0
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
ModerateCVE-2023-3866SUSE bug 1213814cpe:/o:suse:suse-microos:5.0CVE-2023-39190SUSE Linux Enterprise Micro 5.0
** REJECT ** CVE-2023-39190 was found to be a duplicate of CVE-2023-31436. Please see https://access.redhat.com/security/cve/CVE-2023-31436 for information about affected products and security errata.
LowCVE-2023-39190SUSE bug 1216056cpe:/o:suse:suse-microos:5.0CVE-2023-39191SUSE Linux Enterprise Micro 5.0
An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code in the context of the kernel.
ImportantCVE-2023-39191SUSE bug 1215863SUSE bug 1215887cpe:/o:suse:suse-microos:5.0CVE-2023-4004SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.
ImportantCVE-2023-4004SUSE bug 1213812SUSE bug 1214812cpe:/o:suse:suse-microos:5.0CVE-2023-4015SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.
We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2.
ImportantCVE-2023-4015SUSE bug 1215104SUSE bug 1215106cpe:/o:suse:suse-microos:5.0CVE-2023-40791SUSE Linux Enterprise Micro 5.0
extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for try_grab_page.
LowCVE-2023-40791SUSE bug 1216255cpe:/o:suse:suse-microos:5.0CVE-2023-4147SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
ImportantCVE-2023-4147SUSE bug 1213968SUSE bug 1215118cpe:/o:suse:suse-microos:5.0CVE-2023-4155SUSE Linux Enterprise Micro 5.0
A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker manages to call the handler multiple times, they can trigger a stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations without stack guard pages (`CONFIG_VMAP_STACK`).
ModerateCVE-2023-4155SUSE bug 1214022cpe:/o:suse:suse-microos:5.0CVE-2023-4205SUSE Linux Enterprise Micro 5.0
** REJECT ** This was deemed as a false positive both by the reporter and upstream kernel.
LowCVE-2023-4205SUSE bug 1214050cpe:/o:suse:suse-microos:5.0CVE-2023-4273SUSE Linux Enterprise Micro 5.0
A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.
ImportantCVE-2023-4273SUSE bug 1214120SUSE bug 1214123cpe:/o:suse:suse-microos:5.0CVE-2023-42752SUSE Linux Enterprise Micro 5.0
An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers.
ModerateCVE-2023-42752SUSE bug 1215146SUSE bug 1215468cpe:/o:suse:suse-microos:5.0CVE-2023-42756SUSE Linux Enterprise Micro 5.0
A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system.
ModerateCVE-2023-42756SUSE bug 1215767cpe:/o:suse:suse-microos:5.0CVE-2023-4389SUSE Linux Enterprise Micro 5.0
A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may lead to leaked internal kernel information.
ModerateCVE-2023-4389SUSE bug 1214351cpe:/o:suse:suse-microos:5.0CVE-2023-4394SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a system crash or leak internal kernel information
ModerateCVE-2023-4394SUSE bug 1214352cpe:/o:suse:suse-microos:5.0CVE-2023-44466SUSE Linux Enterprise Micro 5.0
An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32.
ImportantCVE-2023-44466SUSE bug 1215871cpe:/o:suse:suse-microos:5.0CVE-2023-4569SUSE Linux Enterprise Micro 5.0
A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause a double-deactivations of catchall elements, which results in a memory leak.
LowCVE-2023-4569SUSE bug 1214729cpe:/o:suse:suse-microos:5.0CVE-2023-45898SUSE Linux Enterprise Micro 5.0
The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent.
LowCVE-2023-45898SUSE bug 1216262cpe:/o:suse:suse-microos:5.0CVE-2023-4611SUSE Linux Enterprise Micro 5.0
A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VMA-locked page fault, and may allow a local attacker to crash the system or lead to a kernel information leak.
ModerateCVE-2023-4611SUSE bug 1214772cpe:/o:suse:suse-microos:5.0CVE-2023-4732SUSE Linux Enterprise Micro 5.0
A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.
ModerateCVE-2023-4732SUSE bug 1214926cpe:/o:suse:suse-microos:5.0CVE-2023-5158SUSE Linux Enterprise Micro 5.0
A flaw was found in vringh_kiov_advance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. This issue may result in a denial of service from guest to host via zero length descriptor.
ModerateCVE-2023-5158SUSE bug 1215710cpe:/o:suse:suse-microos:5.0CVE-2023-5345SUSE Linux Enterprise Micro 5.0
A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation.
In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free.
We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705.
ModerateCVE-2023-5345SUSE bug 1215899SUSE bug 1215971cpe:/o:suse:suse-microos:5.0kernel-defaultSUSE-MicroOS-releaserpcbindopenssllibopenssl1_1openssl-1_1nfs-clientnfs-kernel-servercurllibcurl4kernel-rtopensshlibnm0typelib-1_0-NM-1_0libvorbis0libvorbisenc2libxml2-2libxml2-toolsvim-data-commonvim-smallfuselibfuse2libthai-datalibthai0glibcglibc-localeglibc-locale-basetardbus-1-glibsudologrotatehardlinkaugeasaugeas-lenseslibaugeas0libexpat1squashfslibruby2_5-2_5ruby2.5ruby2.5-stdlibcoreutilslibXext6libXrender1libXv1xen-libslibspice-server1libvirt-daemonlibvirt-daemon-driver-interfacelibvirt-daemon-driver-networklibvirt-daemon-driver-nodedevlibvirt-daemon-driver-nwfilterlibvirt-daemon-driver-qemulibvirt-daemon-driver-secretlibvirt-daemon-driver-storagelibvirt-daemon-driver-storage-corelibvirt-daemon-driver-storage-disklibvirt-daemon-driver-storage-iscsilibvirt-daemon-driver-storage-logicallibvirt-daemon-driver-storage-mpathlibvirt-daemon-driver-storage-rbdlibvirt-daemon-driver-storage-scsilibvirt-daemon-qemulibvirt-libslibjson-c3libyaml-0-2kgraft-patch-3_12_38-44-defaultkgraft-patch-3_12_39-47-defaultkgraft-patch-3_12_43-52_6-defaultkgraft-patch-3_12_44-52_10-defaultkgraft-patch-3_12_44-52_18-defaultkgraft-patch-3_12_48-52_27-defaultkgraft-patch-3_12_49-11-defaultkgraft-patch-3_12_51-52_31-defaultkgraft-patch-3_12_51-52_34-defaultkgraft-patch-3_12_51-52_39-defaultkgraft-patch-3_12_51-60_20-defaultkgraft-patch-3_12_51-60_25-defaultkgraft-patch-3_12_53-60_30-defaultkgraft-patch-3_12_57-60_35-defaultkgraft-patch-3_12_59-60_41-defaultkgraft-patch-3_12_59-60_45-defaultpython3-Jinja2qemuqemu-armqemu-ipxeqemu-ppcqemu-s390qemu-seabiosqemu-sgabiosqemu-toolsqemu-vgabiosqemu-x86libfreebl3libsoftokn3mozilla-nssmozilla-nss-certslibfreetype6libgcrypt20dbus-1libdbus-1-3shimwpa_supplicantkgraft-patch-3_12_32-33-defaultfilefile-magiclibmagic1powerpc-utilsliblzo2-2libpython3_6m1_0python3python3-baseliblz4-1dockerkrb5libevent-2_1-8libzmq5kgraft-patch-3_12_36-38-defaultlibssh4rsynclibgnutls30libpcre1libpcre2-8-0libksba8libjpeg8cpiolibblkid1libfdisk1libmount1libsmartcols1libuuid1util-linuxutil-linux-systemdelfutilslibasm1libdw1libebl-pluginslibelf1lesslibmspack0libpixman-1-0e2fsprogslibcom_err2libext2fs2update-alternativesgreplibldap-2_4-2libldap-datalibssh2-1chronychrony-pool-suselibidn11libidn2-0python3-requestslibtasn1libtasn1-6libpolkit0polkitpamlibunwindlibsqlite3-0libaudit1libauparse0libvmtools0open-vm-toolslibrados2librbd1mozilla-nsprlibsystemd0libudev1systemdsystemd-sysvinitudevlibxslt1libpng16-16grub2grub2-arm64-efigrub2-i386-pcgrub2-powerpc-ieee1275grub2-s390x-emugrub2-snapper-plugingrub2-x86_64-efigrub2-x86_64-xenlibhogweed4libnettle6kgraft-patch-4_4_21-69-defaultkgraft-patch-4_4_21-81-defaultkgraft-patch-4_4_21-84-defaultkgraft-patch-4_4_21-90-defaultkgraft-patch-4_4_38-93-defaultgstreamerlibgstreamer-1_0-0libvirglrenderer0perlperl-baselibgraphite2-3libnghttp2-14python3-saltsaltsalt-minionlibbz2-1dosfstoolsopenslpkgraft-patch-3_12_62-60_62-defaultfirewalldpython3-firewallkdumpcracklibcracklib-dict-smalllibcrack2kgraft-patch-3_12_62-60_64_8-defaultpolicycoreutilspolicycoreutils-python-utilspython3-policycoreutilslibbluetooth3kgraft-patch-3_12_67-60_64_18-defaultdracutpython3-urllib3libcairo2bashlibreadline7kgraft-patch-3_12_67-60_64_21-defaultlibz1containerddocker-runcrunclibopus0libnl-configlibnl3-200kgraft-patch-4_4_103-6_33-defaultkgraft-patch-4_4_103-6_38-defaultkgraft-patch-4_4_82-6_3-defaultkgraft-patch-4_4_82-6_6-defaultkgraft-patch-4_4_82-6_9-defaultkgraft-patch-4_4_92-6_18-defaultkgraft-patch-4_4_92-6_30-defaultkgraft-patch-4_4_49-92_11-defaultkgraft-patch-4_4_49-92_14-defaultkgraft-patch-4_4_59-92_17-defaultkgraft-patch-4_4_59-92_20-defaultkgraft-patch-4_4_59-92_24-defaultkgraft-patch-4_4_74-92_29-defaultkgraft-patch-4_4_74-92_32-defaultkgraft-patch-4_4_74-92_35-defaultkgraft-patch-4_4_74-92_38-defaultkgraft-patch-4_4_90-92_45-defaultkgraft-patch-4_12_14-95_40-defaultkgraft-patch-4_12_14-120-defaultkgraft-patch-4_12_14-122_7-defaultkernel-livepatch-4_12_14-150_41-defaultkernel-livepatch-4_12_14-197_26-defaultkernel-firmwarekgraft-patch-4_4_114-94_11-defaultkgraft-patch-4_4_114-94_14-defaultkgraft-patch-4_4_103-92_53-defaultkgraft-patch-4_4_103-92_56-defaultkgraft-patch-4_4_90-92_50-defaultiscsiuiolibopeniscsiusr0_2_0open-iscsipython3-PyYAMLkernel-livepatch-4_12_14-23-defaultkernel-livepatch-4_12_14-25_3-defaultsalt-transactional-updateucode-intellibyaml-cpp0_6kgraft-patch-3_12_67-60_64_24-defaultkgraft-patch-3_12_69-60_64_29-defaultapparmor-parserkgraft-patch-3_12_69-60_64_32-defaultkgraft-patch-3_12_69-60_64_35-defaultlibzyppzypperzypper-needs-restartingrpmkgraft-patch-4_4_73-5-defaultlibcroco-0_6-3kgraft-patch-4_4_120-94_17-defaultkgraft-patch-4_4_126-94_22-defaultkgraft-patch-4_12_14-95_19-defaultkgraft-patch-4_12_14-95_24-defaultkgraft-patch-4_12_14-95_29-defaultkgraft-patch-4_12_14-95_32-defaultkgraft-patch-4_12_14-95_37-defaultkgraft-patch-4_12_14-95_45-defaultkgraft-patch-4_12_14-95_48-defaultkgraft-patch-4_12_14-95_51-defaultkgraft-patch-4_12_14-122_12-defaultkgraft-patch-4_12_14-122_17-defaultkgraft-patch-4_12_14-122_20-defaultkernel-livepatch-4_12_14-150_22-defaultkernel-livepatch-4_12_14-150_27-defaultkernel-livepatch-4_12_14-150_32-defaultkernel-livepatch-4_12_14-150_35-defaultkernel-livepatch-4_12_14-150_38-defaultkernel-livepatch-4_12_14-150_47-defaultkernel-livepatch-4_12_14-195-defaultkernel-livepatch-4_12_14-197_10-defaultkernel-livepatch-4_12_14-197_15-defaultkernel-livepatch-4_12_14-197_18-defaultkernel-livepatch-4_12_14-197_21-defaultkernel-livepatch-4_12_14-197_29-defaultkernel-livepatch-4_12_14-197_34-defaultkernel-livepatch-4_12_14-197_37-defaultkernel-livepatch-4_12_14-197_4-defaultkernel-livepatch-4_12_14-197_40-defaultkernel-livepatch-4_12_14-197_7-defaultpython3-pyOpenSSLgpg2kgraft-patch-4_4_131-94_29-defaultkgraft-patch-4_4_132-94_33-defaultkernel-livepatch-4_12_14-25_13-defaultkernel-livepatch-4_12_14-25_6-defaultpodmanpodman-cni-configkgraft-patch-4_4_138-94_39-defaultkgraft-patch-4_4_140-94_42-defaultkgraft-patch-4_4_143-94_47-defaultliblldp_clif1open-lldpkernel-livepatch-4_12_14-25_16-defaultlibprocps7procpslibX11-6libX11-datalibX11-xcb1kgraft-patch-4_4_155-94_50-defaultkgraft-patch-4_4_156-94_57-defaultkgraft-patch-4_4_156-94_61-defaultkgraft-patch-4_4_156-94_64-defaultkernel-livepatch-4_12_14-25_19-defaultbtrfsmaintenancelibpango-1_0-0libcontainers-commonpython3-distrolibxkbcommon0glib2-toolslibgio-2_0-0libglib-2_0-0libgmodule-2_0-0libgobject-2_0-0kgraft-patch-4_12_14-94_41-defaultkgraft-patch-4_12_14-95_3-defaultkgraft-patch-4_12_14-95_6-defaultkernel-livepatch-4_12_14-25_28-defaultdocker-libnetworkcni-pluginskgraft-patch-4_4_162-94_69-defaultkgraft-patch-4_4_162-94_72-defaultkernel-livepatch-4_12_14-25_22-defaultkernel-livepatch-4_12_14-25_25-defaultgettext-runtimelibncurses6ncurses-utilsterminfoterminfo-basesupportutilslibsolv-toolskgraft-patch-4_12_14-95_68-defaultkgraft-patch-4_12_14-95_71-defaultkgraft-patch-4_12_14-95_74-defaultkgraft-patch-4_12_14-95_77-defaultkgraft-patch-4_12_14-95_80-defaultkgraft-patch-4_12_14-95_83-defaultkernel-livepatch-4_12_14-150_66-defaultkernel-livepatch-4_12_14-150_69-defaultkernel-livepatch-4_12_14-150_72-defaultkernel-livepatch-4_12_14-150_75-defaultkernel-livepatch-4_12_14-150_78-defaultshadowkgraft-patch-4_12_14-95_13-defaultkgraft-patch-4_12_14-95_16-defaultkernel-livepatch-4_12_14-150_14-defaultkernel-livepatch-4_12_14-150_17-defaultkgraft-patch-4_4_175-94_79-defaultkgraft-patch-4_4_176-94_88-defaultkgraft-patch-4_4_178-94_91-defaultkgraft-patch-4_4_180-94_97-defaultlibzstd1dnsmasqucode-amdkgraft-patch-4_12_14-95_54-defaultkernel-livepatch-4_12_14-150_52-defaultlibfribidi0kernel-default-basepython3-psutilwickedwicked-servicelibesmtplibbsd0iproute2python3-setuptoolspermissionslibgbm1liblua5_3-5slirp4netnslibseccomp2gstreamer-plugins-baselibgstallocators-1_0-0libgstapp-1_0-0libgstaudio-1_0-0libgstgl-1_0-0libgstpbutils-1_0-0libgstriff-1_0-0libgsttag-1_0-0libgstvideo-1_0-0kgraft-patch-4_12_14-95_57-defaultkgraft-patch-4_12_14-95_60-defaultkernel-livepatch-4_12_14-150_55-defaultkernel-livepatch-4_12_14-150_58-defaultkernel-livepatch-4_12_14-150_63-defaultkgraft-patch-4_12_14-95_65-defaultkgraft-patch-4_12_14-122_23-defaultkgraft-patch-4_12_14-122_26-defaultkgraft-patch-4_12_14-122_29-defaultkgraft-patch-4_12_14-122_32-defaultkgraft-patch-4_12_14-122_37-defaultkgraft-patch-4_12_14-122_41-defaultkgraft-patch-4_12_14-122_46-defaultkgraft-patch-4_12_14-122_51-defaultkgraft-patch-4_12_14-122_54-defaultkernel-livepatch-4_12_14-197_45-defaultkernel-livepatch-4_12_14-197_48-defaultkernel-livepatch-4_12_14-197_51-defaultkernel-livepatch-4_12_14-197_56-defaultkernel-livepatch-4_12_14-197_61-defaultkernel-livepatch-4_12_14-197_64-defaultkernel-livepatch-4_12_14-197_67-defaultkernel-livepatch-4_12_14-197_72-defaultkernel-livepatch-4_12_14-197_75-defaultkernel-livepatch-5_3_18-22-defaultkernel-livepatch-5_3_18-24_12-defaultkernel-livepatch-5_3_18-24_15-defaultkernel-livepatch-5_3_18-24_9-defaultkernel-livepatch-5_3_18-24_24-defaultkernel-livepatch-5_3_18-24_29-defaultkernel-livepatch-5_3_18-24_34-defaultkernel-livepatch-5_3_18-24_37-defaultkernel-livepatch-5_3_18-24_43-defaultglib-networkinglibgcc_s1libstdc++6libproxy1kgraft-patch-4_12_14-122_60-defaultkgraft-patch-4_12_14-122_63-defaultkernel-livepatch-4_12_14-197_83-defaultkernel-livepatch-4_12_14-197_86-defaultkernel-livepatch-5_3_18-24_49-defaultkernel-livepatch-5_3_18-24_52-defaultkernel-livepatch-5_3_18-57-defaultpython3-asn1cryptopython3-cffipython3-cryptographypython3-pyasn1python3-pycparserkgraft-patch-4_12_14-122_57-defaultkernel-livepatch-4_12_14-197_78-defaultlibp11-kit0p11-kitp11-kit-toolskernel-livepatch-5_3_18-24_46-defaultpython3-pykgraft-patch-4_12_14-122_66-defaultkernel-livepatch-5_3_18-24_53_4-defaultkgraft-patch-4_12_14-122_71-defaultkgraft-patch-4_12_14-122_74-defaultkgraft-patch-4_12_14-122_77-defaultkernel-livepatch-4_12_14-197_89-defaultkernel-livepatch-4_12_14-197_92-defaultkernel-livepatch-5_3_18-24_61-defaultkernel-livepatch-5_3_18-24_64-defaultkernel-livepatch-5_3_18-24_67-defaultkgraft-patch-4_12_14-95_102-defaultkgraft-patch-4_12_14-95_105-defaultkgraft-patch-4_12_14-95_88-defaultkgraft-patch-4_12_14-95_93-defaultkgraft-patch-4_12_14-95_96-defaultkgraft-patch-4_12_14-95_99-defaultkgraft-patch-4_12_14-122_103-defaultkgraft-patch-4_12_14-122_106-defaultkgraft-patch-4_12_14-122_110-defaultkgraft-patch-4_12_14-122_113-defaultkgraft-patch-4_12_14-122_116-defaultkgraft-patch-4_12_14-122_121-defaultkgraft-patch-4_12_14-122_124-defaultkgraft-patch-4_12_14-122_127-defaultkgraft-patch-4_12_14-122_130-defaultkgraft-patch-4_12_14-122_88-defaultkgraft-patch-4_12_14-122_91-defaultkgraft-patch-4_12_14-122_98-defaultkernel-livepatch-4_12_14-150000_150_89-defaultkernel-livepatch-4_12_14-150000_150_92-defaultkernel-livepatch-4_12_14-150000_150_95-defaultkernel-livepatch-4_12_14-150000_150_98-defaultkernel-livepatch-4_12_14-150_83-defaultkernel-livepatch-4_12_14-150_86-defaultkernel-livepatch-4_12_14-150100_197_111-defaultkernel-livepatch-4_12_14-150100_197_114-defaultkernel-livepatch-4_12_14-150100_197_117-defaultkernel-livepatch-4_12_14-150100_197_120-defaultkernel-livepatch-4_12_14-197_102-defaultkernel-livepatch-4_12_14-197_105-defaultkernel-livepatch-4_12_14-197_108-defaultkernel-livepatch-5_3_18-150200_24_112-defaultkernel-livepatch-5_3_18-150200_24_115-defaultkernel-livepatch-5_3_18-150200_24_126-defaultkernel-livepatch-5_3_18-24_102-defaultkernel-livepatch-5_3_18-24_107-defaultkernel-livepatch-5_3_18-24_83-defaultkernel-livepatch-5_3_18-24_86-defaultkernel-livepatch-5_3_18-24_93-defaultkernel-livepatch-5_3_18-24_96-defaultkernel-livepatch-5_3_18-24_99-defaultkernel-livepatch-5_3_18-150300_59_43-defaultkernel-livepatch-5_3_18-150300_59_46-defaultkernel-livepatch-5_3_18-150300_59_49-defaultkernel-livepatch-5_3_18-150300_59_54-defaultkernel-livepatch-5_3_18-150300_59_60-defaultkernel-livepatch-5_3_18-150300_59_63-defaultkernel-livepatch-5_3_18-150300_59_68-defaultkernel-livepatch-5_3_18-150300_59_71-defaultkernel-livepatch-5_3_18-150300_59_76-defaultkernel-livepatch-5_3_18-150300_59_87-defaultkernel-livepatch-5_3_18-59_24-defaultkernel-livepatch-5_3_18-59_27-defaultkernel-livepatch-5_3_18-59_34-defaultkernel-livepatch-5_3_18-59_37-defaultkernel-livepatch-5_3_18-59_40-defaultkernel-livepatch-5_14_21-150400_22-defaultkernel-livepatch-5_14_21-150400_24_11-defaultkernel-livepatch-5_14_21-150400_24_18-defaultkgraft-patch-4_12_14-122_80-defaultkgraft-patch-4_12_14-122_83-defaultkernel-livepatch-4_12_14-197_99-defaultkernel-livepatch-5_3_18-24_70-defaultkernel-livepatch-5_3_18-24_75-defaultkernel-livepatch-5_3_18-24_78-defaultkernel-livepatch-5_3_18-59_10-defaultkernel-livepatch-5_3_18-59_13-defaultkernel-livepatch-5_3_18-59_16-defaultkernel-livepatch-5_3_18-59_19-defaultkernel-livepatch-5_3_18-59_5-defaultkmodkmod-compatlibkmod2perl-Bootloaderpython3-rpmlibprotobuf-lite20libfuse3-3libhivex0perl-Win-Hivexkernel-livepatch-5_3_18-150200_24_129-defaultkernel-livepatch-5_3_18-150200_24_134-defaultkernel-livepatch-5_3_18-150300_59_90-defaultkernel-livepatch-5_3_18-150300_59_93-defaultkernel-livepatch-5_3_18-150300_59_98-defaultkernel-livepatch-5_14_21-150400_24_21-defaultkernel-livepatch-5_14_21-150400_24_28-defaultkernel-livepatch-5_14_21-150400_24_33-defaultsystemd-containercryptsetuplibcryptsetup12python3-Babellibgmp10libharfbuzz0gzipliblzma5xzcyrus-saslcyrus-sasl-digestmd5libsasl2-3kernel-livepatch-5_3_18-150300_59_101-defaultkgraft-patch-4_12_14-95_108-defaultkgraft-patch-4_12_14-95_111-defaultkgraft-patch-4_12_14-122_133-defaultkgraft-patch-4_12_14-122_136-defaultkernel-livepatch-4_12_14-150100_197_123-defaultkernel-livepatch-4_12_14-150100_197_126-defaultkernel-livepatch-4_12_14-150000_150_101-defaultkernel-livepatch-4_12_14-150000_150_104-defaultkgraft-patch-4_12_14-95_114-defaultkgraft-patch-4_12_14-122_139-defaultkgraft-patch-4_12_14-122_144-defaultkernel-livepatch-4_12_14-150100_197_131-defaultkernel-livepatch-5_3_18-150200_24_139-defaultkernel-livepatch-5_14_21-150400_15_5-rtkernel-livepatch-5_14_21-150400_24_38-defaultkernel-livepatch-5_3_18-150200_24_142-defaultkernel-livepatch-5_3_18-150200_24_145-defaultkernel-livepatch-5_3_18-150300_59_106-defaultkernel-livepatch-5_3_18-150300_59_109-defaultkernel-livepatch-5_3_18-150300_59_112-defaultkernel-livepatch-5_3_18-150300_59_115-defaultkernel-livepatch-5_14_21-150400_15_8-rtkernel-livepatch-5_14_21-150400_24_41-defaultkgraft-patch-4_12_14-122_147-defaultkernel-livepatch-5_14_21-150400_15_11-rtkernel-livepatch-5_14_21-150400_15_18-rtkernel-livepatch-5_14_21-150400_15_23-rtkernel-livepatch-5_14_21-150400_24_46-defaultkernel-livepatch-5_14_21-150400_24_55-defaultkernel-livepatch-5_14_21-150400_24_60-defaultkgraft-patch-4_12_14-95_117-defaultkernel-livepatch-4_12_14-150100_197_134-defaultkgraft-patch-4_12_14-122_150-defaultkgraft-patch-4_12_14-122_153-defaultkgraft-patch-4_12_14-122_156-defaultkgraft-patch-4_12_14-122_159-defaultkgraft-patch-4_12_14-122_162-defaultkernel-livepatch-4_12_14-150100_197_137-defaultkernel-livepatch-4_12_14-150100_197_142-defaultkernel-livepatch-4_12_14-150100_197_145-defaultkernel-livepatch-5_3_18-150200_24_148-defaultkernel-livepatch-5_3_18-150200_24_151-defaultkernel-livepatch-5_3_18-150200_24_154-defaultkernel-livepatch-5_3_18-150300_59_118-defaultkernel-livepatch-5_3_18-150300_59_121-defaultkernel-livepatch-5_3_18-150300_59_124-defaultkernel-livepatch-5_14_21-150400_15_28-rtkernel-livepatch-5_14_21-150400_24_63-defaultkernel-livepatch-5_14_21-150400_24_66-defaultkernel-livepatch-5_14_21-150500_11-rtkernel-livepatch-5_14_21-150500_53-defaultkgraft-patch-4_12_14-95_120-defaultkgraft-patch-4_12_14-122_165-defaultkgraft-patch-4_12_14-122_173-defaultkernel-livepatch-4_12_14-150100_197_148-defaultkernel-livepatch-4_12_14-150100_197_151-defaultkernel-livepatch-4_12_14-150100_197_154-defaultkernel-livepatch-5_3_18-150200_24_157-defaultkernel-livepatch-5_3_18-150200_24_160-defaultkernel-livepatch-5_3_18-150300_59_127-defaultkernel-livepatch-5_3_18-150300_59_130-defaultkernel-livepatch-5_14_21-150400_15_37-rtkernel-livepatch-5_14_21-150500_13_5-rtkernel-livepatch-5_14_21-150400_15_40-rtkernel-livepatch-5_14_21-150400_24_69-defaultkernel-livepatch-5_14_21-150400_24_74-defaultkernel-livepatch-5_14_21-150500_55_12-defaultkernel-livepatch-5_14_21-150500_55_7-defaultkgraft-patch-4_12_14-95_125-defaultkernel-livepatch-5_14_21-150400_15_46-rtkernel-livepatch-5_14_21-150400_24_81-defaultkernel-livepatch-5_14_21-150500_13_11-rtkernel-livepatch-5_14_21-150500_55_19-default05.00:1.22.10-3.3.40:1.3.6-4.3.10:8.0.1568-5.11.10:2.9.7-3.3.10:0.1.27-1.160:2.26-13.51.10:1.30-3.3.20:0.108-1.290:3.13.0-4.3.90:1.0+git.e66999f-1.250:1.10.1-1.110:2.2.5-3.6.10:4.3-1.290:2.5.8-4.11.10:8.29-2.120:1.3.3-1.300:0.9.10-1.300:1.0.11-1.230:4.13.2_06-3.22.10:0.14.2-3.3.10:0.13-1.190:0.1.7-1.170:3.12.38-44.10:5-2.1-00:3.12.39-47.10:3.12.43-52.6.10:3.12.44-52.10.10:4-2.1-00:3.12.44-52.18.10:3.12.48-52.27.10:3-2.1-00:3.12.49-11.10:5-14.2-00:3.12.51-52.31.10:3.12.51-52.34.10:3.12.51-52.39.10:2-2.1-00:3.12.51-60.20.20:3.12.51-60.25.10:3.12.53-60.30.10:3.12.57-60.35.10:2-2.2-00:3.12.59-60.41.20:3.12.59-60.45.20:3.12.59-60.45.20:2.10.1-3.5.10:2.9.7-3.28.10:4.2.1-11.13.10:1.0.0+-11.13.10:1.12.1+-11.13.10:8-11.13.10:3.53.1-3.51.10:2.10.1-4.8.10:1.1.1d-11.12.10:1.1.1d-1.460:1.8.2-8.36.10:1.12.2-8.3.10:15+git47-3.13.10:2.9-4.23.10:3.12.32-33.10:3.12.32-33.10:5.32-7.11.20:1.3.7.1-3.27.10:2.10-2.220:3.6.12-3.75.10:19.03.15_ce-6.46.10:1.16.3-3.15.10:2.1.8-2.230:4.2.3-3.15.40:3.12.36-38.10:3.12.36-38.10:6.0.0-13.8.10:0.8.7-10.12.10:7.66.0-4.11.10:2-7.1-00:2-10.1-00:3.12.39-47.10:3.1.3-4.3.10:3.6.7-14.7.10:8.41-4.200:10.31-1.140:1.3.5-2.140:8.1.2-5.15.70:2.12-3.3.10:2.33.1-4.13.10:2.33.1-4.13.20:0.168-4.5.30:530-1.60:0.6-3.8.190:1.8.22-4.15.10:1.43.8-4.23.10:1.19.0.4-2.480:3.1-4.3.120:2-3.1-00:2.4.46-9.45.10:1.9.0-4.13.10:2-6.1-00:3.12.43-52.6.10:1.34-3.2.20:2.2.0-3.6.10:2.20.1-6.6.10:4.13-4.5.10:2-5.1-00:3.12.49-11.10:0.116-1.510:1.3.0-6.29.10:1.2.1-4.2.3(aarch64|x86_64)0:3.36.0-3.12.10:2.8.1-12.3.10:11.2.5-4.12.10:4-2.3-00:2-4.1-00:3.12.44-52.18.10:4.25.1-3.15.20:0.2.3-5.9.20:246.10-2.30:1.1.32-3.8.240:3.12.51-60.25.10:1.6.34-3.9.10:8.1p1-5.12.30:2.04-9.30.10:3.12.51-60.20.20:3-8.2-00:6-2.1-00:4-11.2-00:3.12.53-60.30.10:3.4.1-4.12.1(aarch64|x86_64)0:2.26-13.65.10:4.4.21-69.10:4.4.21-81.30:4.4.21-84.10:4.4.21-90.10:4.4.38-93.10:4.4.38-93.10:1.16.2-1.530:0.6.0-4.3.1(aarch64|x86_64)0:2.26-13.62.10:1.3.11-2.120:1.40.0-1.150:3.2-9.18.10:3.12.57-60.35.10:3000-24.10:1.0.6-5.9.10:2.0.0-6.12.20:6-17.2-00:3.12.59-60.41.20:7-20.2-00:7-2.1-00:3.12.62-60.62.10:3-5.1-00:3.12.62-60.62.10:0.5.5-4.24.90:0.9.0-11.3.10:2.9.7-11.3.10:2-9.1-00:3.12.62-60.64.8.20:3.12.62-60.64.8.20:8-23.2-00:8-2.1-00:3.1-1.250:3.12.67-60.64.18.10:4.4.21-81.30:049.1+suse.186.g320cc3d1-1.10:1.24-9.10.10:1.16.0-1.550:4.4-9.10.10:7.0-9.10.10:3.12.67-60.64.21.10:4.4.21-84.10:5.48-13.3.10:1.2.11-3.18.10:1.3.9-5.29.30:1.0.0rc10+gitr3981_dc9208a3303f-6.45.30:1.0.0~rc10-1.9.10:1.3.1-3.6.10:4.4.103-6.33.10:5-2.2-00:4.4.103-6.38.10:4.4.82-6.3.10:8-2.2-00:4.4.82-6.6.10:7-2.2-00:4.4.82-6.9.10:4.4.92-6.18.10:6-2.2-00:4.4.92-6.30.10:4.4.92-6.30.10:9-18.10.1-00:9-2.1-00:4.4.49-92.11.10:4.4.49-92.14.10:4.4.59-92.17.30:4.4.59-92.20.20:4.4.59-92.24.20:4.4.74-92.29.10:4.4.74-92.32.10:4.4.74-92.35.10:4.4.74-92.38.10:4.4.74-92.38.10:10-18.13.1-00:10-4.1-00:9-4.1-00:7-4.1-00:6-4.1-00:5-4.1-00:4-4.1-00:3-4.1-00:4.4.74-92.35.10:4.4.82-6.3.10:5.3.18-24.49.20:5.3.18-8.3.10:7-21.1-00:7-3.1-00:6-3.1-00:4-3.1-00:3-3.1-00:4.4.59-92.20.20:4.4.90-92.45.10:4.4.90-92.45.10:4.4.92-6.18.10:4.12.14-95.40.10:4.12.14-95.40.10:4.12.14-120.10:8-21.2-00:4.12.14-122.7.10:4.12.14-122.7.10:4.12.14-150.41.10:4.12.14-150.41.10:4.12.14-197.26.10:4.12.14-197.26.10:11-2.1-00:4.4.59-92.24.20:10-2.1-00:4.4.82-6.9.10:5.26.1-7.12.10:20200107-3.15.10:4.4.114-94.11.30:4.4.114-94.14.10:4.4.21-69.10:4.4.103-92.53.10:4.4.103-92.56.10:4.4.90-92.50.10:4.4.90-92.50.10:5.1.2-6.6.10:4.12.14-23.10:4.12.14-25.3.10:4.12.14-25.3.10:8-18.7.1-00:4.4.49-92.11.10:20210216-2.19.10:0.6.1-4.2.10:3.12.67-60.64.24.10:3.12.69-60.64.29.10:4-11.1-00:2.13.4-3.3.10:3.12.69-60.64.32.10:3.12.69-60.64.35.10:4.4.49-92.14.10:17.25.6-3.28.20:1.14.42-3.17.10:4.14.1-20.30:4.4.74-92.29.10:4.4.73-5.10:2-2.3.2-00:4.4.73-5.10:0.6.13-1.260:3-2.2-00:4.4.120-94.17.10:4.4.126-94.22.10:4.12.14-95.19.10:4.12.14-95.24.10:4.12.14-95.29.10:4.12.14-95.32.10:4.12.14-95.37.10:4.12.14-95.45.10:4.12.14-95.48.10:4.12.14-95.51.10:4.12.14-95.51.10:5-12.2-00:4.12.14-122.12.10:4.12.14-122.17.10:4.12.14-122.20.10:4.12.14-150.22.10:4.12.14-150.27.10:4.12.14-150.32.10:4.12.14-150.35.10:4.12.14-150.38.10:4.12.14-150.47.10:4.12.14-150.47.10:4.12.14-195.10:12-34.1-00:4.12.14-197.10.10:4.12.14-197.15.10:4.12.14-197.18.10:4.12.14-197.21.10:4.12.14-197.29.10:4.12.14-197.34.10:4.12.14-197.37.10:4.12.14-197.4.10:4.12.14-197.40.10:4.12.14-197.7.10:4.12.14-197.7.10:2.2.5-4.14.40:4.4.131-94.29.10:4.4.132-94.33.10:4.12.14-25.13.10:3-2.3-00:4.12.14-25.6.10:4.12.14-25.6.10:2.1.1-4.28.10:4.4.138-94.39.10:4.4.140-94.42.10:4.4.143-94.47.10:4-10.2-00:4.12.14-25.16.10:3.3.15-7.13.20:9-25.2-00:4.12.14-23.10:1.6.5-3.12.10:4.4.155-94.50.10:4.4.156-94.57.10:4.4.156-94.61.10:4.4.156-94.64.10:5-13.2-00:4.12.14-25.19.1(x86_64)0:0.6-3.11.10:0.4.2-1.110:4.4.140-94.42.10:10-28.1-00:1.44.7+11-1.250:3-7.3-00:20200727-3.12.1(noarch)0:1.5.0-3.5.1(aarch64|x86_64)0:3002.2-37.10:0.8.2-3.3.10:2.62.6-3.3.10:4.12.14-94.41.10:9-2.25.1-00:4.12.14-95.3.10:8-2.5-00:4.12.14-95.6.10:7-2.5-00:4.12.14-95.6.10:4.12.14-25.28.10:7-2.3-00:4.12.14-25.28.10:0.7.0.1+gitr2908_55e924b8a842-4.31.10:4.4.162-94.69.20:4.4.162-94.72.10:4.4.162-94.72.10:3-2.7.2-00:4.12.14-95.3.10:8-22.2-00:4.12.14-25.22.10:4.12.14-25.25.10:6-16.2-0(x86_64)0:0.6-3.14.10:0.19.8.1-4.11.10:6.1-5.6.20:3.1.9-5.24.30:3.28.0-3.9.2(aarch64|x86_64)0:1.34-150000.3.12.10:0.7.16-3.13.1(aarch64|x86_64)0:0.6.1-4.5.10:4.12.14-95.68.10:14-2.2-00:4.12.14-95.71.10:13-2.2-00:4.12.14-95.74.10:10-2.2-00:4.12.14-95.77.10:9-2.2-00:4.12.14-95.80.10:4.12.14-95.83.20:4.12.14-95.83.20:4.12.14-150.66.10:4.12.14-150.69.10:4.12.14-150.72.10:4.12.14-150.75.10:4.12.14-150.78.10:4.12.14-150.78.1(aarch64|x86_64)0:1.2.11-150000.3.30.10:5-2.5-00:4-2.5-00:2-2.5-00:10-2.5-00:9-2.5-00:12-2.1-00:4.4.132-94.33.10:7-19.2-00:4.6-3.5.60:6-15.2-00:4.12.14-120.10:4.12.14-95.13.10:6-2.5-00:4.12.14-95.16.10:4.12.14-150.14.20:6-2.3-00:4.12.14-150.17.10:5-2.13.1-00:4.4.175-94.79.10:4.4.176-94.88.10:4.4.178-94.91.20:4.4.178-94.91.20:6-2.16.1-00:4-10.1-00:4.12.14-195.10:4.4.180-94.97.10:4.4.180-94.97.10:1.4.4-1.3.10:3-7.2-00:4.12.14-197.4.10:7-2.19.1-00:6-16.1-00:4.12.14-95.45.10:4.12.14-197.29.10:4.12.14-197.18.1(noarch)0:20200107-3.23.10:4.12.14-95.29.10:4.12.14-150.32.1(aarch64|x86_64)0:4.2.1-11.19.2(aarch64)0:4.2.1-11.19.2(noarch)0:1.0.0+-11.19.2(noarch)0:1.12.1+-11.19.2(noarch)0:8-11.19.2(x86_64)0:4.2.1-11.19.20:4-2.2-00:4.12.14-95.54.10:4.12.14-95.54.10:4.12.14-150.52.10:4.12.14-150.52.10:8-2.22.1-00:7-19.1-00:1.8.0-3.5.1(aarch64|x86_64)0:1.0.5-3.3.1(aarch64|x86_64)0:5.3.18-24.61.1(aarch64|x86_64)0:5.3.18-24.61.1.9.26.4(x86_64)0:5.3.18-8.7.10:0.6.64-3.3.4(aarch64|x86_64)0:1.0.6-150.4.10:0.8.7-3.3.17(aarch64|x86_64)0:8.45-20.10.10:40.5.0-6.3.1(x86_64)0:4.12.14-10.49.10:20181224-23.3.10:2.1.1-10.10.10:19.3.4-45.230:3-6.2-00:10-28.2-00:5.3.4-3.3.20:0.4.7-3.12.10:4-2.10.2-00:4.4.175-94.79.10:4.12.14-95.48.10:4.12.14-197.37.10:2.4.1-3.3.10:1.16.2-2.120:4.12.14-95.57.10:4.12.14-95.60.10:4.12.14-95.60.10:4.12.14-150.55.10:4.12.14-150.58.10:4.12.14-150.58.10:7-18.2-00:4.12.14-197.40.10:4.12.14-150.63.10:4.12.14-150.69.10:4.12.14-95.65.10:4.12.14-95.65.10:4.12.14-122.23.10:4.12.14-122.26.10:4.12.14-122.29.10:4.12.14-122.32.10:4.12.14-122.37.10:4.12.14-122.41.10:4.12.14-122.46.10:4.12.14-122.51.20:4.12.14-122.54.10:4.12.14-122.54.10:4.12.14-150.63.10:4.12.14-197.45.10:4.12.14-197.48.10:4.12.14-197.51.10:4.12.14-197.56.10:4.12.14-197.61.10:4.12.14-197.64.10:4.12.14-197.67.10:4.12.14-197.72.10:4.12.14-197.75.10:4.12.14-197.75.10:5.3.18-22.20:7-5.2-00:5.3.18-24.12.10:5.3.18-24.15.10:5.3.18-24.9.10:5.3.18-24.9.10:5.3.18-24.24.10:5.3.18-24.29.20:5.3.18-24.34.10:5.3.18-24.37.10:5.3.18-24.43.20:0.8.6-3.8.1(aarch64|x86_64)0:1.40.0-3.5.1(aarch64|x86_64)0:1.12.2-8.11.20:4.12.14-197.61.1(aarch64|x86_64)0:5.3.18-24.52.1(aarch64|x86_64)0:5.3.18-24.52.1.9.24.1(aarch64|x86_64)0:3.68-3.56.1(aarch64|x86_64)0:4.32-3.20.10:4-9.1-00:11-31.2-0(aarch64|x86_64)0:0.13-3.3.1(aarch64|x86_64)0:0.6.13-3.3.1(aarch64|x86_64)0:4.2.1-11.16.3(aarch64)0:4.2.1-11.16.3(noarch)0:1.0.0+-11.16.3(noarch)0:1.12.1+-11.16.3(noarch)0:8-11.16.3(x86_64)0:4.2.1-11.16.3(aarch64|x86_64)0:4.2.1-11.34.2(aarch64)0:4.2.1-11.34.2(noarch)0:1.0.0+-11.34.2(noarch)0:1.12.1+-11.34.2(noarch)0:8-11.34.2(x86_64)0:4.2.1-11.34.2(aarch64|x86_64)0:2.62.4-3.3.10:10.2.1+git583-1.3.4(aarch64|x86_64)0:0.7.8.6-22.14.1(aarch64|x86_64)0:2.1.4-22.14.1(aarch64|x86_64)0:2.86-7.14.10:4.12.14-95.57.10:4.12.14-150.55.10:4.12.14-197.51.10:2-5.2-00:2-2.3-0(aarch64|x86_64)0:5.3.1-6.10.10:4.12.14-197.56.10:4.12.14-197.45.10:5.3.18-22.2(aarch64|x86_64)0:8.1.2-5.18.1(aarch64|x86_64)0:5.3.6-3.6.1(x86_64)0:20210525-7.1(aarch64|x86_64)0:5.3.18-24.67.3(aarch64|x86_64)0:5.3.18-24.67.3.9.30.2(x86_64)0:5.3.18-8.13.10:0.4.15-4.3.1(aarch64|x86_64)0:2.5.8-4.14.10:9-3.2-00:4.12.14-197.67.10:5-5.2-00:4.12.14-95.71.10:4.12.14-122.60.10:4.12.14-122.63.10:4.12.14-122.63.10:4.12.14-197.83.10:4.12.14-197.86.10:4.12.14-197.86.10:5.3.18-24.49.20:5.3.18-24.52.10:5.3.18-24.52.10:5.3.18-57.30:10-3.2-00:5.3.18-57.3(noarch)0:0.24.0-3.2.1(aarch64|x86_64)0:1.13.2-3.2.5(aarch64|x86_64)0:2.8-10.1(noarch)0:17.5.0-8.3.1(noarch)0:0.4.2-3.2.1(noarch)0:2.17-3.2.1(noarch)0:1.25.10-9.14.1(aarch64|x86_64)0:5.3.18-24.70.1(aarch64|x86_64)0:5.3.18-24.70.1.9.32.10:11-2.2-00:4.12.14-122.57.10:4.12.14-122.60.10:4.12.14-197.78.10:4.12.14-197.78.1(aarch64|x86_64)0:5.3.18-24.99.1(aarch64|x86_64)0:5.3.18-24.99.1.9.46.1(x86_64)0:5.3.18-62.20:8-5.2-0(aarch64|x86_64)0:0.4.7-3.15.1(aarch64|x86_64)0:0.23.2-4.13.10:4.12.14-95.68.10:4.12.14-150.66.10:4.12.14-197.83.10:5.3.18-24.46.10:6-5.2-00:4.12.14-122.57.1(noarch)0:1.8.1-5.6.1(aarch64|x86_64)0:4.2.1-11.28.1(aarch64)0:4.2.1-11.28.1(noarch)0:1.0.0+-11.28.1(noarch)0:1.12.1+-11.28.1(noarch)0:8-11.28.1(x86_64)0:4.2.1-11.28.1(aarch64|x86_64)0:1.12.2-8.6.10:12-2.2-00:4.12.14-122.66.20:4.12.14-122.66.20:11-5.2-00:5.3.18-24.53.4.10:4.12.14-95.77.10:15-2.2-00:4.12.14-122.71.10:4.12.14-122.74.10:4.12.14-122.77.10:4.12.14-122.77.10:4.12.14-150.72.10:4.12.14-197.89.20:4.12.14-197.92.10:4.12.14-197.92.10:14-5.2-00:5.3.18-24.61.10:5.3.18-24.64.10:5.3.18-24.67.30:4.12.14-95.102.10:4.12.14-95.105.10:13-2.3-00:4.12.14-95.88.10:9-2.3-00:4.12.14-95.93.10:8-2.3-00:4.12.14-95.96.10:4.12.14-95.99.30:4.12.14-95.99.30:4.12.14-122.103.10:14-2.3-00:4.12.14-122.106.10:12-2.3-00:4.12.14-122.110.10:10-2.3-00:4.12.14-122.113.10:4.12.14-122.116.10:4.12.14-122.121.20:5-2.3-00:4.12.14-122.124.30:4.12.14-122.127.10:4.12.14-122.130.10:4.12.14-122.88.10:16-2.3-00:4.12.14-122.91.20:4.12.14-122.98.10:4.12.14-122.98.10:4.12.14-150000.150.89.10:7-150000.2.2-00:4.12.14-150000.150.92.20:4-150000.2.1-00:4.12.14-150000.150.95.10:2-150000.2.1-00:4.12.14-150000.150.98.10:13-150000.2.2-00:4.12.14-150.83.10:9-150000.2.2-00:4.12.14-150.86.10:8-150000.2.2-00:4.12.14-150.86.10:4.12.14-150100.197.111.10:7-150100.2.2-00:4.12.14-150100.197.114.20:4-150100.2.1-00:4.12.14-150100.197.117.10:2-150100.2.1-00:4.12.14-150100.197.120.10:4.12.14-197.102.20:13-150100.2.2-00:4.12.14-197.105.10:9-150100.2.2-00:4.12.14-197.108.10:8-150100.2.2-00:4.12.14-197.108.10:5.3.18-150200.24.112.10:7-150200.2.2-00:5.3.18-150200.24.115.10:5-150200.2.1-00:5.3.18-150200.24.126.10:2-150200.2.1-00:5.3.18-24.102.10:12-150200.2.2-00:5.3.18-24.107.10:11-150200.2.2-00:5.3.18-24.83.20:16-150200.2.2-00:5.3.18-24.86.20:5.3.18-24.93.10:15-150200.2.2-00:5.3.18-24.96.10:14-150200.2.2-00:5.3.18-24.99.10:13-150200.2.2-00:5.3.18-24.99.10:5.3.18-150300.59.43.10:13-150300.2.2-00:5.3.18-150300.59.46.10:5.3.18-150300.59.49.10:12-150300.2.2-00:5.3.18-150300.59.54.10:11-150300.2.2-00:5.3.18-150300.59.60.40:10-150300.2.2-00:5.3.18-150300.59.63.10:7-150300.2.2-00:5.3.18-150300.59.68.10:6-150300.2.2-00:5.3.18-150300.59.71.20:5-150300.2.1-00:5.3.18-150300.59.76.10:4-150300.2.1-00:5.3.18-150300.59.87.10:3-150300.2.1-00:5.3.18-59.24.10:16-150300.2.2-00:5.3.18-59.27.10:5.3.18-59.34.10:15-150300.2.2-00:5.3.18-59.37.20:14-150300.2.2-00:5.3.18-59.40.10:5.3.18-59.40.10:5.14.21-150400.22.10:5-150400.4.12.3-00:5.14.21-150400.24.11.10:2-150400.2.1-00:5.14.21-150400.24.18.10:5.14.21-150400.24.18.10:6-150000.2.1-00:15-150000.2.2-00:11-150000.2.2-00:10-150000.2.2-00:4.12.14-95.80.10:4.12.14-122.80.10:4.12.14-122.83.10:4.12.14-122.88.10:4.12.14-150.75.10:4.12.14-197.99.10:4.12.14-197.99.10:5.3.18-24.70.10:5.3.18-24.75.30:5.3.18-24.78.10:5.3.18-24.78.10:5.3.18-59.10.10:8-150300.2.2-00:5.3.18-59.13.10:5.3.18-59.16.10:5.3.18-59.19.10:5.3.18-59.5.20:5.3.18-59.5.2(aarch64|x86_64)0:5.3.18-24.86.2(aarch64|x86_64)0:5.3.18-24.86.2.9.40.2(x86_64)0:5.3.18-54.1(aarch64|x86_64)0:25-6.10.1(aarch64|x86_64)0:0.931-3.5.10:4.12.14-197.64.1(noarch)0:20200107-3.26.1(x86_64)0:4.13.3_02-3.34.1(x86_64)0:20220207-10.10:13-5.2-00:4.12.14-122.32.10:13-2.1-00:2-150300.2.1-00:12-3.1-00:10-150300.2.1-00:9-150300.2.1-00:8-150300.2.1-00:6-150300.2.1-0(aarch64|x86_64)0:5.3.18-150200.24.112.1(aarch64|x86_64)0:5.3.18-150200.24.112.1.150200.9.52.2(x86_64)0:5.3.18-150200.79.20:5.3.18-24.53.4.10:9-3.1-0(aarch64|x86_64)0:5.3.18-24.96.1(aarch64|x86_64)0:5.3.18-24.96.1.9.44.1(aarch64|x86_64)0:0.14.2-3.6.1(aarch64|x86_64)0:3.6.7-14.10.2(aarch64|x86_64)0:4.14.1-22.4.1(aarch64|x86_64)0:4.14.1-22.4.2(aarch64|x86_64)0:3.4.1-4.15.10:5.3.18-24.93.1(aarch64|x86_64)0:1.4.4-5.32.1(aarch64|x86_64)0:20.10.6_ce-6.49.3(aarch64|x86_64)0:1.0.0~rc93-1.14.2(aarch64|x86_64)0:5.3.18-24.78.1(aarch64|x86_64)0:5.3.18-24.78.1.9.36.1(x86_64)0:5.3.18-48.1(aarch64|x86_64)0:3002.2-49.20:16-2.2-00:4.12.14-122.80.10:5.3.18-24.75.30:5-3.1-0(aarch64|x86_64)0:5.3.18-24.75.3(aarch64|x86_64)0:5.3.18-24.75.3.9.34.3(x86_64)0:5.3.18-45.3(aarch64|x86_64)0:3.9.2-4.12.1(aarch64|x86_64)0:5.3.18-24.102.1(aarch64|x86_64)0:5.3.18-24.102.1.9.48.1(x86_64)0:5.3.18-73.1(aarch64|x86_64)0:7.66.0-4.14.1(aarch64|x86_64)0:7.66.0-4.17.1(aarch64|x86_64)0:7.66.0-4.22.1(aarch64|x86_64)0:7.66.0-4.27.10:4.12.14-95.74.10:4.12.14-122.71.10:4.12.14-197.89.20:5.3.18-24.64.1(aarch64|x86_64)0:3.6.13-3.78.1(aarch64|x86_64)0:1.1.1d-11.17.1(aarch64|x86_64)0:4.25.1-3.17.1(aarch64|x86_64)0:1.4.4-1.6.1(x86_64)0:4.13.4_08-150200.3.50.10:10-5.2-0(aarch64|x86_64)0:2.62.6-3.6.10:9-5.2-0(aarch64|x86_64)0:2.62.6-150200.3.9.1(x86_64)0:4.13.2_08-3.25.3(x86_64)0:4.13.3_04-3.37.1(x86_64)0:4.13.4_02-3.40.1(x86_64)0:5.3.18-65.2(aarch64|x86_64)0:2.5.9-4.17.1(aarch64|x86_64)0:5.3.18-24.64.1(aarch64|x86_64)0:5.3.18-24.64.1.9.28.1(x86_64)0:5.3.18-8.10.1(aarch64|x86_64)0:2.9-4.29.1(aarch64|x86_64)0:1.4.11-56.1(aarch64|x86_64)0:20.10.9_ce-156.1(aarch64|x86_64)0:1.0.2-23.1(aarch64|x86_64)0:1.6.5-3.21.1(noarch)0:1.6.5-3.21.1(aarch64|x86_64)0:1.8.22-4.18.1(aarch64|x86_64)0:2.5.9-150000.4.23.1(aarch64|x86_64)0:1.16.3-3.3.1(aarch64|x86_64)0:1.16.3-4.3.10:12-5.2-0(aarch64|x86_64)0:1.8.2-8.39.1(aarch64|x86_64)0:2.26-13.59.10:6-150100.2.1-00:15-150100.2.2-00:11-150100.2.2-00:10-150100.2.2-00:10-150200.2.2-00:8-150200.2.1-00:18-150200.2.2-00:17-150200.2.2-00:9-150300.2.2-00:7-150300.2.1-00:18-150300.2.2-00:17-150300.2.2-00:8-150400.4.21.1-00:5-150400.2.1-00:5.14.21-150400.24.11.1(aarch64|x86_64)0:3.6.15-3.91.3(aarch64|x86_64)0:3.6.15-3.91.4(aarch64|x86_64)0:1.1.1d-11.20.1(aarch64|x86_64)0:5.3.18-24.83.2(aarch64|x86_64)0:5.3.18-24.83.2.9.38.3(x86_64)0:5.3.18-51.20:8-3.2-0(aarch64|x86_64)0:1.3.14-5.3.1(aarch64|x86_64)0:15.2.12.83+g528da226523-3.25.1(aarch64|x86_64)0:2.9.7-3.34.1(aarch64|x86_64)0:1.8.0-3.8.1(aarch64|x86_64)0:2.9.7-3.37.1(aarch64|x86_64)0:5.3.18-24.93.1(aarch64|x86_64)0:5.3.18-24.93.1.9.42.5(x86_64)0:5.3.18-57.1(aarch64|x86_64)0:4.2.1-11.22.1(aarch64)0:4.2.1-11.22.1(noarch)0:1.0.0+-11.22.1(noarch)0:1.12.1+-11.22.1(noarch)0:8-11.22.1(x86_64)0:4.2.1-11.22.1(aarch64|x86_64)0:0.116-3.3.10:4.12.14-122.83.1(aarch64|x86_64)0:3.4.1-4.18.1(aarch64|x86_64)0:4.2.1-11.25.2(aarch64)0:4.2.1-11.25.2(noarch)0:1.0.0+-11.25.2(noarch)0:1.12.1+-11.25.2(noarch)0:8-11.25.2(x86_64)0:4.2.1-11.25.20:5.3.18-24.70.1(aarch64|x86_64)0:1.3.14-5.6.1(aarch64|x86_64)0:1.16.3-3.21.1(aarch64|x86_64)0:6.0.0-13.16.20:11-2.3-00:6-3.2-0(aarch64|x86_64)0:6.0.0-13.21.1(aarch64|x86_64)0:1.1.1d-11.27.1(aarch64|x86_64)0:1.1.1d-11.30.1(aarch64|x86_64)0:4.2.1-11.31.3(aarch64)0:4.2.1-11.31.3(noarch)0:1.0.0+-11.31.3(noarch)0:1.12.1+-11.31.3(noarch)0:8-11.31.3(x86_64)0:4.2.1-11.31.3(aarch64|x86_64)0:2.33.2-4.16.1(aarch64|x86_64)0:1.16.3-3.24.1(noarch)0:8.0.1568-5.17.1(aarch64|x86_64)0:8.0.1568-5.17.1(aarch64|x86_64)0:2.12-3.9.1(aarch64|x86_64)0:6.1-5.9.10:2-150200.2.2-00:3-150200.2.2-00:5.3.18-150200.24.129.10:5.3.18-150200.24.134.10:4-150200.2.1-00:3-150200.2.1-00:12-150200.2.1-00:14-150200.2.1-00:11-150200.2.1-00:10-150200.2.1-00:7-150200.2.1-00:6-150200.2.1-00:2-150300.2.2-00:3-150300.2.2-00:5.3.18-150300.59.90.10:5.3.18-150300.59.93.10:5.3.18-150300.59.98.10:14-150200.3.1-00:12-150300.2.1-00:11-150300.2.1-00:2-150400.4.3.3-00:5.14.21-150400.24.21.20:2-150400.2.2-00:5.14.21-150400.24.28.10:5.14.21-150400.24.33.20:5.14.21-150400.24.33.20:15-2.1-00:14-2.1-00:4.12.14-95.96.10:15-150000.2.1-00:12-150000.2.1-00:7-150000.2.1-00:3-150000.2.1-0(aarch64|x86_64)0:6.0.0-13.24.10:13-150200.3.1-00:4-150300.2.2-0(aarch64|x86_64)0:0.116-3.6.10:5.3.18-24.96.10:11-3.2-00:5-150300.2.2-0(x86_64)0:5.3.18-68.1(aarch64|x86_64)0:1.4.12-60.1(aarch64|x86_64)0:20.10.12_ce-159.1(aarch64|x86_64)0:0.116-3.9.1(aarch64|x86_64)0:8.1p1-5.21.10:4.12.14-122.91.20:5.3.18-24.86.2(aarch64|x86_64)0:3.6.7-14.16.1(noarch)0:2.8.0-3.3.1(aarch64|x86_64)0:3.68.1-3.61.1(aarch64|x86_64)0:1.5.11-150000.68.1(aarch64|x86_64)0:20.10.14_ce-150000.163.1(aarch64|x86_64)0:6.1.2-4.9.1(aarch64|x86_64)0:1.0.3-27.1(aarch64|x86_64)0:5.3.18-24.107.1(aarch64|x86_64)0:5.3.18-24.107.1.9.50.2(aarch64|x86_64)0:2.2.5-3.9.1(x86_64)0:5.3.18-76.1(aarch64|x86_64)0:0.6.0-4.9.1(aarch64|x86_64)0:0.6.0-4.6.10:16-2.1-00:16-150000.2.1-00:13-150000.2.1-00:8-150000.2.1-00:8-150100.2.1-00:16-150100.2.1-00:15-150100.2.1-00:13-150100.2.1-00:16-150200.2.1-00:13-150200.2.1-00:9-150200.2.1-00:16-150200.3.1-00:14-150300.2.1-00:13-150300.2.1-00:10-150000.2.1-00:5-150000.2.1-00:5-150100.2.1-00:12-150100.2.1-00:10-150100.2.1-00:4.12.14-95.88.10:4.12.14-150.83.1(aarch64|x86_64)0:1.1.1d-11.43.1(aarch64|x86_64)0:2.86-150100.7.20.10:7-150100.2.1-00:3-150100.2.1-00:14-150100.2.1-00:15-150200.2.1-00:15-150200.3.1-00:4.12.14-95.93.10:5.14.21-150400.22.10:14-150000.2.2-00:5-150000.2.2-00:4-150000.2.2-00:5-150100.2.2-00:4-150100.2.2-00:16-150100.2.2-00:14-150100.2.2-00:8-150200.2.2-00:9-150200.2.2-00:18-150200.3.2-0(aarch64|x86_64)0:3.68.3-150000.3.67.10:4-150200.2.2-00:19-150200.3.2-0(aarch64|x86_64)0:1.10-150200.10.1(aarch64|x86_64)0:5.2.3-150000.4.7.10:17-150200.3.1-00:15-150300.2.1-0(aarch64|x86_64)0:1.43.8-150000.4.33.10:17-2.2-00:6-150000.2.2-00:12-150000.2.2-00:6-150100.2.2-00:12-150100.2.2-00:6-150400.4.15.3-00:6-150200.2.2-00:4-150400.4.9.3-00:18-2.3-00:17-2.3-00:5-150000.2.3-00:16-150000.2.3-00:11-150000.2.3-00:7-150000.2.3-00:6-150000.2.3-00:5-150100.2.3-00:11-150100.2.3-00:7-150100.2.3-00:6-150100.2.3-00:16-150100.2.3-00:5-150200.2.3-00:10-150200.2.3-00:9-150200.2.3-00:18-150200.2.3-00:17-150200.2.3-00:16-150200.2.3-00:14-150200.2.3-00:13-150200.2.3-00:12-150200.2.3-00:11-150200.2.3-00:11-150300.2.3-00:10-150300.2.3-00:9-150300.2.3-00:8-150300.3.2-00:5-150300.2.3-00:4-150300.2.3-00:18-150300.2.3-00:17-150300.2.3-00:16-150300.2.3-00:14-150300.2.3-00:13-150300.2.3-00:12-150300.2.3-00:3-150400.4.6.2-0(aarch64|x86_64)0:3002.2-150200.64.10:11-150100.2.1-0(x86_64)0:4.13.4_04-3.43.2(aarch64|x86_64)0:2.9-4.33.1(aarch64|x86_64)0:2.2.5-3.12.1(aarch64|x86_64)0:2.1.26-5.10.1(aarch64|x86_64)0:2.2.5-3.15.1(aarch64|x86_64)0:2.2.5-3.19.10:5.3.18-150300.59.101.10:5.3.18-150300.59.98.10:10-150400.4.2-00:7-150400.2.1-00:6-150400.2.1-00:4-150400.2.1-00:3-150400.2.1-00:14-150000.2.1-00:11-150000.2.1-00:3-150100.2.2-00:3-150400.2.2-00:16-150000.2.2-00:19-150300.2.2-00:4.12.14-122.130.10:4.12.14-150100.197.120.10:5.3.18-150200.24.126.10:3-150000.2.2-00:4.12.14-95.108.10:4.12.14-95.111.10:4.12.14-122.133.10:4.12.14-122.136.10:4.12.14-122.136.10:4.12.14-150100.197.123.10:4.12.14-150100.197.126.10:5.14.21-150400.24.28.10:4.12.14-150000.150.101.10:4.12.14-150000.150.104.10:9-150400.4.24.1-00:4.12.14-95.114.10:4.12.14-122.139.10:4.12.14-122.144.10:4.12.14-122.144.10:9-150100.2.1-00:4.12.14-150100.197.131.10:5.3.18-150200.24.139.10:5.3.18-24.107.10:11-150400.7.2-00:8-150400.2.1-00:7-150400.4.18.3-00:5.14.21-150400.24.21.20:5.14.21-150400.24.38.10:0:5.3.18-150200.24.142.10:5-150200.2.2-00:5.3.18-150200.24.145.10:5.3.18-150200.24.145.10:5.3.18-150300.59.106.10:5.3.18-150300.59.109.10:5.3.18-150300.59.112.10:5.3.18-150300.59.115.20:12-150400.2.3-00:5.14.21-150400.24.41.10:4.12.14-122.147.10:4.12.14-122.147.10:6-150200.2.3-00:3-150200.2.3-00:5.3.18-150200.24.139.10:3-150300.2.3-00:8-150300.2.3-00:6-150300.2.3-00:4-150400.2.3-00:12-150400.10.3-00:9-150400.2.3-00:8-150400.2.3-00:6-150400.2.3-00:5-150400.2.3-00:3-150400.2.3-00:4-150400.2.2-00:6-150400.2.2-00:5-150400.2.2-00:14-150400.16.1-00:11-150400.2.3-00:10-150400.2.3-00:7-150400.2.3-00:5.14.21-150400.24.46.10:5.14.21-150400.24.55.30:5.14.21-150400.24.60.10:2-150400.2.3-00:8-150200.2.3-00:4-150200.2.3-00:7-150300.2.3-00:4.12.14-95.117.10:4.12.14-150100.197.134.10:4.12.14-150100.197.134.10:5.3.18-150200.24.142.10:13-150400.13.2-00:10-150400.2.2-00:9-150400.2.2-00:7-150400.2.2-00:4.12.14-122.150.10:4.12.14-122.153.10:4.12.14-122.156.10:4.12.14-122.159.10:4.12.14-122.162.10:4.12.14-122.162.10:8-150100.2.3-00:4.12.14-150100.197.137.20:4.12.14-150100.197.142.10:4.12.14-150100.197.145.10:4.12.14-150100.197.145.10:5.3.18-150200.24.148.10:5.3.18-150200.24.151.10:5.3.18-150200.24.154.10:5.3.18-150200.24.154.10:5.3.18-150300.59.118.10:5.3.18-150300.59.121.20:5.3.18-150300.59.124.10:8-150400.2.2-00:14-150400.2.2-00:13-150400.2.2-00:11-150400.2.2-00:5.14.21-150400.24.63.10:5.14.21-150400.24.66.10:3-150500.6.2-00:5.14.21-150500.53.20:2-150200.2.3-00:2-150300.2.3-00:4.12.14-95.120.40:4.12.14-122.150.10:4.12.14-122.153.10:2-150100.2.2-00:4.12.14-150100.197.137.20:4.12.14-95.120.40:4.12.14-122.165.10:4.12.14-122.173.10:4.12.14-122.173.10:4.12.14-150100.197.148.10:4.12.14-150100.197.151.10:4.12.14-150100.197.154.10:4.12.14-150100.197.154.10:5.3.18-150200.24.157.10:5.3.18-150200.24.160.20:5.3.18-150200.24.160.20:5.3.18-150300.59.127.10:5.3.18-150300.59.130.10:12-150400.2.2-00:4-150500.9.2-00:3-150500.2.1-00:5.3.18-150200.24.148.10:4.12.14-122.156.10:4.12.14-150100.197.142.10:4.12.14-150100.197.148.10:2-150500.3.1-00:5.14.21-150400.24.69.10:5.14.21-150400.24.74.10:2-150500.2.1-00:5.14.21-150500.55.12.10:5.14.21-150500.55.7.10:4.12.14-122.159.10:5.3.18-150200.24.151.10:4.12.14-95.114.10:4.12.14-150100.197.131.10:13-150100.2.3-00:10-150100.2.3-00:3-150100.2.3-00:2-150100.2.3-00:4.12.14-95.125.10:4.12.14-95.125.10:4.12.14-122.165.10:4.12.14-150100.197.151.10:5.3.18-150200.24.157.10:5.14.21-150400.24.81.10:5.14.21-150500.55.19.1